CVE-2026-48823

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionality of Shaarli. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark (Shaare). The malicious payload is stored and later executed when users interact with the "Filter by tag" search feature on the homepage. User-supplied input in the tags field is not properly sanitized or output-escaped before being rendered in the tag filtering interface. When a bookmark is created with a malicious payload inside the tag field, the payload is stored in the database. Later, when a user searches using the "Filter by tag" functionality on the homepage, the application renders matching tags dynamically. If the tag value contains HTML with JavaScript event handlers, it is injected into the DOM. This impacts anyone interacting with the "Filter by tag" search functionality, administrators and privileged users. This issue has been fixed in version 0.16.2.

• CWE-79

• https://github.com/shaarli/Shaarli/releases/tag/v0.16.2
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-68qr-fvv8-6mc6
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-68qr-fvv8-6mc6

Published

Jun 17, 2026

Last Modified

Jun 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48818Starlette is a lightweight ASGI framework/toolkit. In versio…7.5
• CVE-2026-48819Hey API is an ecosystem for turning API specifications into …4.8
• CVE-2026-4882The User Registration Advanced Fields plugin for WordPress i…9.8
• CVE-2026-48820CakePHP is a rapid development framework for PHP. In version…6.3
• CVE-2026-48821Shaarli is a personal bookmarking service. Versions 0.16.1 a…5.8
• CVE-2026-48822Shaarli is a personal bookmarking service. Versions 0.16.1 a…5.8
• CVE-2026-48824Mailpit is an email testing tool and API for developers. Pri…5.3
• CVE-2026-48827Path traversal vulnerability in Apache MINA SSHD bundle sshd…7.1
• CVE-2026-48828The Bulk Variables API in Apache Airflow called the redactor…6.5
• CVE-2026-48829In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dere…7.5
• CVE-2026-4883The Piotnet Forms plugin for WordPress is vulnerable to arbi…9.8
• CVE-2026-48831Wine ships a .desktop file that registers itself as a MIME h…7.3