CVE-2025-49588 Details
Description
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.
A local file inclusion vulnerability has been identified in Linkwarden version 2.10.2. The issue arises because the server accepts links in the 'file://' format, such as 'file:///etc/passwd', and fails to validate them before passing to parsers and Playwright. This lack of validation can lead to unauthorized access to other users' links and, in some cases, environment secrets. The vulnerability allows an attacker to exploit the incremental and easily brute-forgeable 'userIds' and 'fileIds' to access and leak data from other users.
Users can upgrade to Linkwarden version 2.10.3, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2025CISA-ADP
Assessed Jul 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/linkwarden/linkwarden/security/advisories/GHSA-rfc2-x8hr-536q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/linkwarden/linkwarden/security/advisories/GHSA-rfc2-x8hr-536q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Linkwarden | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2025 | CVE Modified | CISA-ADP |
| Jul 2, 2025 | New CVE Received | [email protected] |