DEBIAN-CVE-2026-110225

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-110225

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110225.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-110225

Upstream

CVE-2026-110225

Published

2026-10-13T19:18:47Z

Modified

2026-10-14T17:00:48Z

Severity

2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.

References

https://security-tracker.debian.org/tracker/CVE-2026-110225

Affected packages

Debian:12 / shaarli

Package

Name: shaarli
Purl: pkg:deb/debian/shaarli?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.12.1+dfsg-8

0.12.1+dfsg-8+deb12u1

0.12.1+dfsg-8+deb12u2

0.13.0+dfsg-1

0.13.0+dfsg-2

0.13.0+dfsg-3

0.13.0+dfsg-4

0.13.0+dfsg-5

0.14.0+dfsg-1

0.14.0+dfsg-2

0.15.0+dfsg-1

0.16.1+dfsg-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110225.json"

Debian:13 / shaarli