CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page
Attackers can execute arbitrary scripts in Shaarli via stored XSS in bookmark titles, potentially leading to administrator account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50190?
CVE-2026-50190 is a high-severity cross-site scripting vulnerability in Shaarli, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-50190?
How do I fix CVE-2026-50190?
No fix has been published for CVE-2026-50190 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-50190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50190 exists.
Sources
Also known as DEBIAN-CVE-2026-50190, GHSA-xm98-h5jj-64xv, UBUNTU-CVE-2026-50190.