CVE-2026-50190: Stored XSS via raw bookmark title in document <title> element on public permalink page

Published Aug 20, 2026
·
Updated

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark->getTitle() into the pagetitle template variable and the RainTPL template emits it into the document <title> element without HTML escaping. A bookmark title containing </title><script>...</script> closes the document title early and the injected script executes in the Shaarli origin for any visitor of /shaare/{hash}. Shaarli's metadata fetcher copies a remote page's <title> text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.

Affected Software

1 affected component
Shaarli Shaarli<0.16.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Shaarli to a version that resolves this vulnerability.

    Fixed in 0.16.3
  2. Compensating control

    If you cannot upgrade immediately, block or restrict access to Shaarli public permalinks (/shaare/{hash}) until fixed to reduce the impact of stored XSS.

Event History

Aug 20, 2026
CVE Published
via MITRE·06:49 PM
Data Sourced
via MITRE·06:49 PM
DescriptionWeakness

Frequently Asked Questions

1

Who can trigger the stored payload?

An attacker can host a page with a malicious HTML title and persuade a Shaarli administrator to bookmark that URL. Shaarli's metadata fetcher copies the remote page title verbatim into the bookmark title, planting the payload without further attacker interaction.

2

Which users are exposed after a malicious bookmark is saved?

Any visitor who opens the affected bookmark's public permalink at /shaare/{hash} executes the injected script in the Shaarli origin. This includes the administrator, and the payload can execute on the administrator's first save.

3

What versions should be remediated?

Versions prior to 0.16.3 are affected. Version 0.16.3 fixes the issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203