UBUNTU-CVE-2026-105263

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-105263
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-105263.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-105263
Upstream
Published
2026-10-06T00:00:00Z
Modified
2026-10-06T10:48:20Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.

References

Affected packages

Ubuntu:16.04:LTS / shaarli

Package

Name
shaarli
Purl
pkg:deb/ubuntu/shaarli?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0.42~beta~dfsg1-2
0.0.42~beta~dfsg1-2ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "shaarli",
            "binary_version": "0.0.42~beta~dfsg1-2ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-105263.json"