CVE-2026-110225— Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route
Quick assessment
Affected
shaarli Shaarli
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Shaarli 0.16.9 及更早版本存在服务器端请求伪造（SSRF）漏洞，允许经过身份验证的用户在获取书签缩略图时，因缺少对私有地址的检查，从而诱导服务器向内部地址发起请求。攻击者可以创建指向回环地址、私有网络地址或云元数据地址的书签，并通过触发 ThumbnailsController::ajaxUpdate 方法或保存操作，发送盲式 GET 请求。若部署了 open_shaarli 功能，则该漏洞可对任何访问者开放利用。
Possible ATT&CK Techniques 2 AI
T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110225
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route
Source: CVE Program / CVE List V5
Vulnerability Description
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-110225
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110225
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-110225 (2)
Vendor Advisories for CVE-2026-110225 (1)
News Coverage for CVE-2026-110225 (1)
Vendor Pages for CVE-2026-110225 (1)
IV. Related Vulnerabilities
Same product: Shaarli
-
CVE-2026-105263
Shaarli Admin Metadata Endpoint MetadataController.php Metad -
CVE-2026-50190
Shaarli vulnerable to stored XSS via raw bookmark title in d -
CVE-2026-48821
Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail S -
CVE-2026-48823
Shaarli has Stored Cross-Site Scripting (XSS) via Tags Searc -
CVE-2026-48822
Shaarli has Stored Cross-Site Scripting (XSS) via Markdown R
Same vendor: shaarli
-
CVE-2026-50190
Shaarli vulnerable to stored XSS via raw bookmark title in d -
CVE-2026-48821
Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail S -
CVE-2026-48823
Shaarli has Stored Cross-Site Scripting (XSS) via Tags Searc -
CVE-2026-48822
Shaarli has Stored Cross-Site Scripting (XSS) via Markdown R -
CVE-2026-24476
Shaarli vulnerable to stored XSS via Suggested Tags
Same weakness: CWE-918
-
CVE-2026-39989
SSRF in QNAP Download Station -
CVE-2026-3712
PhastPress <= 3.10 - Unauthenticated Server-Side Request For -
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and custom -
CVE-2026-0311
Checkov by Prisma Cloud: Server-Side Request Forgery Vulnera -
CVE-2026-55385
InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer ho
V. Comments for CVE-2026-110225
No comments yet