CVE-2026-50190 - Stored XSS via raw bookmark title in document element on public permalink page
Brief
CVE ID : CVE-2026-50190
Published : Aug. 20, 2026, 6:49 p. m.
- 19 minutes ago
Description : Shaarli is a personal bookmarking service. Versions prior to 0.
- 3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController. php`. The `permalink` handler concatenates the raw `$bookmark-getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document ` ` element without HTML escaping.
A bookmark title containing ` ` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`.