{"id":"UBUNTU-CVE-2026-110225","details":"Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.","modified":"2026-10-17T12:59:51.643541075Z","published":"2026-10-13T19:18:00Z","upstream":["CVE-2026-110225"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-110225"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-110225"},{"type":"REPORT","url":"https://github.com/shaarli/Shaarli"},{"type":"REPORT","url":"https://github.com/shaarli/Shaarli/blob/bfeadb4e5856702c05279bb2a5c405f2ed802015/application/Thumbnailer.php#L82-L98"},{"type":"REPORT","url":"https://github.com/shaarli/Shaarli/blob/bfeadb4e5856702c05279bb2a5c405f2ed802015/application/front/controller/admin/ThumbnailsController.php#L46-L64"},{"type":"REPORT","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/shaarli-open-mode-thumbnail-fetch-ssrf"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/shaarli-through-0.16.9-ssrf-via-thumbnail-retrieval-update-thumbnail-route"}],"affected":[{"package":{"name":"shaarli","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/shaarli?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.42~beta~dfsg1-2","0.0.42~beta~dfsg1-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"shaarli","binary_version":"0.0.42~beta~dfsg1-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110225.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}