CVE-2025-53838 LinkAce has a Stored One Click XSS vulnerability
Attackers can inject malicious JavaScript into LinkAce links, executing arbitrary code in victims' browsers upon clicking, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-53838?
CVE-2025-53838 is a high-severity cross-site scripting vulnerability in Kovah LinkAce, published on 8 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability was discovered in versions prior to 2.1.9 that allows an attacker to inject arbitrary JavaScript, which is then executed in the context of a user's browser when the malicious link is clicked. This is a one-click XSS, meaning the victim only needs to click a crafted link — no further interaction is required. The application contains a stored XSS vulnerability due to insufficient filtering and escaping of user-supplied data inserted into link attributes. Malicious JavaScript code can be saved in the database along with the link and executed in the user’s browser when clicking the link, leading to arbitrary script execution within the context of the site. Version 2.1.9 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-53838?
It affects 1 product.
Products include Linkace Linkace.
How do I fix CVE-2025-53838?
No fix has been published for CVE-2025-53838 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-53838 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53838 exists.
Other vulnerabilities in Kovah LinkAce
- CVE-2026-27458 LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description
- CVE-2025-62722 LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature
- CVE-2026-33953 LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce
- CVE-2026-30953 LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
- CVE-2024-56508 File Upload Vulnerability Leading to XSS in LinkAce v1.15.5
Sources
Also known as GHSA-vwmx-v9qf-q656.