{"id":"CVE-2026-110225","summary":"Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route","details":"Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.","modified":"2026-10-14T10:46:47.137628361Z","published":"2026-10-13T18:50:10.481Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110225.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110225.json"},{"type":"PACKAGE","url":"https://github.com/shaarli/Shaarli"},{"type":"ARTICLE","url":"https://github.com/shaarli/Shaarli/blob/bfeadb4e5856702c05279bb2a5c405f2ed802015/application/Thumbnailer.php#L82-L98"},{"type":"ARTICLE","url":"https://github.com/shaarli/Shaarli/blob/bfeadb4e5856702c05279bb2a5c405f2ed802015/application/front/controller/admin/ThumbnailsController.php#L46-L64"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/shaarli-open-mode-thumbnail-fetch-ssrf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110225"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/shaarli-through-0.16.9-ssrf-via-thumbnail-retrieval-update-thumbnail-route"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/shaarli/shaarli","events":[{"introduced":"0"},{"last_affected":"bfeadb4e5856702c05279bb2a5c405f2ed802015"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.16.9"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.16.9","v0.16.8","v0.16.7","v0.16.6","v0.16.5","v0.16.4","v0.16.3","v0.16.2","v0.16.1","v0.16.0","v0.7.0","help","v0.8.1","v0.8.0","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.5.4","v0.5.3","0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.0.45beta","v0.0.44beta","v0.0.43beta","v0.0.42beta","v0.0.41beta","v0.0.40beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110225.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}