CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
Remote attackers can exploit a server-side request forgery vulnerability in the Shaarli admin metadata endpoint to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105263?
CVE-2026-105263 is a medium-severity server-side request forgery vulnerability in Shaarli, published on 5 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.
Weakness: CWE-918
Which versions are affected by CVE-2026-105263?
How do I fix CVE-2026-105263?
No fix has been published for CVE-2026-105263 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-105263 being exploited?
There is no known exploitation of CVE-2026-105263 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-105263, GHSA-2rmx-qf8h-6p5c, GHSA-85jx-fhrf-q9w7, UBUNTU-CVE-2026-105263.