UBUNTU-CVE-2026-48821

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-48821
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48821.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-48821
Upstream
Published
2026-06-17T21:16:00Z
Modified
2026-06-24T11:01:45Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted into the DOM using innerHTML without proper sanitization. The issue originates from the interaction between the backend thumbnail update endpoint and the frontend JavaScript responsible for rendering update progress. On the backend, the ThumbnailsController::ajaxUpdate method returns bookmark data formatted using the 'raw' formatter. This includes the unescaped bookmark title in the JSON response. On the client side, the script thumbnails-update.js processes this AJAX response and dynamically updates the progress interface. Administrators using the thumbnail synchronization feature are affected and exploitation could lead to session hijacking, privilege escalation, backdoor injection and full compromise. This issue has been fixed in version 0.16.2.

References

Affected packages

Ubuntu:16.04:LTS / shaarli

Package

Name
shaarli
Purl
pkg:deb/ubuntu/shaarli?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0.42~beta~dfsg1-2
0.0.42~beta~dfsg1-2ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "shaarli",
            "binary_version": "0.0.42~beta~dfsg1-2ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48821.json"