CVE-2026-105263
mediumA security flaw has been discovered in Shaarli up to 0.16.3.
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/shaarli/Shaarli/ cna@vuldb.com
- https://github.com/shaarli/Shaarli/commit/8ca4de8e7c932a684481f5fbb1229fe16de1f4d2 cna@vuldb.com
- https://github.com/shaarli/Shaarli/releases/tag/v0.16.4 cna@vuldb.com
- https://github.com/shaarli/Shaarli/security/advisories/GHSA-85jx-fhrf-q9w7 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-105263 cna@vuldb.com
- https://vuldb.com/submit/972906 cna@vuldb.com
- https://vuldb.com/vuln/413464 cna@vuldb.com
- https://vuldb.com/vuln/413464/cti cna@vuldb.com