CVE-2026-50190

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark->getTitle() into the pagetitle template variable and the RainTPL template emits it into the document <title> element without HTML escaping. A bookmark title containing </title><script>...</script> closes the document title early and the injected script executes in the Shaarli origin for any visitor of /shaare/{hash}. Shaarli's metadata fetcher copies a remote page's <title> text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.