CVE-2026-105263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105263
Aliases
  • GHSA-85jx-fhrf-q9w7
Downstream
Published
2026-10-05T08:45:13Z
Modified
2026-10-07T02:47:32Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
Details

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105263.json"
}
References

Affected packages

Git / github.com/shaarli/shaarli

Affected ranges

Type
GIT
Repo
https://github.com/shaarli/shaarli
Events
Introduced
ff053b0df1f920b623ad1e9902b2ccf6a8bc073a
Fixed
8ca4de8e7c932a684481f5fbb1229fe16de1f4d2
Fixed
5ce1d41fe553d30334a166645308a12946abf752
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.16.0"
        },
        {
            "last_affected": "0.16.0"
        },
        {
            "introduced": "0.16.1"
        },
        {
            "last_affected": "0.16.1"
        },
        {
            "introduced": "0.16.2"
        },
        {
            "last_affected": "0.16.2"
        },
        {
            "introduced": "0.16.3"
        },
        {
            "last_affected": "0.16.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.16.0
0.16.1
0.16.2
0.16.3
v0.*
v0.16.0
v0.16.1
v0.16.2
v0.16.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105263.json"