CVE-2026-110225

Deferred Deferred - Pending Action

Shaarli SSRF via Bookmark Thumbnails in 0.16.9

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110225

EUVD

EUVD-2026-99010

Affected Vendors & Products

Vendor	Product	Version / Range
shaarli	Shaarli	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Shaarli through version 0.16.9. When Shaarli runs in open mode, unauthenticated visitors can create bookmarks pointing to internal, loopback, or private addresses. Triggering thumbnail updates sends blind GET requests to these targets, bypassing private-address checks. The issue stems from insufficient URL validation in the thumbnail refresh endpoint.

Detection Guidance

To detect this SSRF vulnerability in Shaarli, check if the open_shaarli setting is enabled and thumbnails are configured to fetch external URLs. Inspect server logs for outbound requests to internal or unexpected addresses triggered by thumbnail updates. Look for bookmarks with URLs pointing to loopback, private, or cloud metadata addresses.

Impact Analysis

An attacker could exploit this to make your Shaarli server send requests to internal systems, potentially accessing sensitive services like databases or cloud metadata. This could lead to data leaks, unauthorized actions, or internal network reconnaissance. The impact depends on your server's internal network and services.

Compliance Impact

This SSRF vulnerability could violate compliance requirements by exposing internal systems to unauthorized access. GDPR requires protecting personal data, while HIPAA mandates securing health information. An SSRF flaw could lead to breaches, triggering regulatory penalties or fines for inadequate security controls.

Mitigation Strategies

Disable open mode by setting security.open_shaarli=false. Disable thumbnail fetching by setting thumbnails.mode=none or disable the feature entirely. Update Shaarli to the latest version where this issue may be patched. Restrict network access to the Shaarli instance to prevent unauthorized requests.

Hi! I’m here to help you understand CVE-2026-110225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70