CVE-2026-110225

Name	CVE-2026-110225
Description	Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
shaarli (PTS)	bookworm, bookworm (security)	0.12.1+dfsg-8+deb12u2	vulnerable
	trixie (security), trixie	0.14.0+dfsg-2+deb13u1	vulnerable
	sid	0.16.1+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
shaarli	source	(unstable)	(unfixed)

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/shaarli-open-mode-thumbnail-fetch-ssrf