CVE-2025-55291

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-55291
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55291.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-55291
Aliases
  • GHSA-7w7w-pw4j-265h
Downstream
Published
2025-08-18T17:06:35Z
Modified
2026-08-12T03:51:28Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Shaarli allows reflected XSS via searchtags parameter
Details

Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-80",
        "CWE-87"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55291.json"
}
References

Affected packages

Git / github.com/shaarli/shaarli

Affected ranges

Type
GIT
Repo
https://github.com/shaarli/shaarli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
66faa61335a6e72184be64092ff1242ffa4fe5b6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.15.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.5.3
Other
help
v0.*
v0.0.40beta
v0.0.41beta
v0.0.42beta
v0.0.43beta
v0.0.44beta
v0.0.45beta
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.7.0
v0.8.0
v0.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55291.json"