CVE-2026-50190: Stored XSS via raw bookmark title in document <title> element on public permalink page
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark->getTitle() into the pagetitle template variable and the RainTPL template emits it into the document <title> element without HTML escaping. A bookmark title containing </title><script>...</script> closes the document title early and the injected script executes in the Shaarli origin for any visitor of /shaare/{hash}. Shaarli's metadata fetcher copies a remote page's <title> text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shaarlito a version that resolves this vulnerability.Fixed in 0.16.3 - Compensating control
If you cannot upgrade immediately, block or restrict access to Shaarli public permalinks (/shaare/{hash}) until fixed to reduce the impact of stored XSS.
Event History
Frequently Asked Questions
Who can trigger the stored payload?
An attacker can host a page with a malicious HTML title and persuade a Shaarli administrator to bookmark that URL. Shaarli's metadata fetcher copies the remote page title verbatim into the bookmark title, planting the payload without further attacker interaction.
Which users are exposed after a malicious bookmark is saved?
Any visitor who opens the affected bookmark's public permalink at /shaare/{hash} executes the injected script in the Shaarli origin. This includes the administrator, and the payload can execute on the administrator's first save.
What versions should be remediated?
Versions prior to 0.16.3 are affected. Version 0.16.3 fixes the issue.