CVE-2025-62722 Details
Description
LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a Stored Cross-Site Scripting (XSS) vulnerability that allows any authenticated user to inject arbitrary JavaScript by creating a link with malicious HTML in the title field. When a user views the link details page and the shareable links are rendered, the malicious JavaScript executes in their browser. This vulnerability affects multiple sharing services and can be exploited to steal session cookies, perform actions on behalf of users, or deliver malware. This issue is fixed in version 2.4.0.
A stored cross-site scripting vulnerability has been identified in LinkAce versions through 2.3.1. This issue allows authenticated users to inject arbitrary JavaScript by entering malicious HTML into the link title field. The vulnerability arises when the injected script is executed in the browser of users viewing the link details page, particularly in the shareable links section. This flaw can be exploited to steal session cookies, perform actions on behalf of users, or deliver malware.
Update to LinkAce version 2.4.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kovah/LinkAce/security/advisories/GHSA-4mxh-7c7f-q79j | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Kovah/LinkAce/commit/95d29b71ad9d4750cff8bbe7488802f6a4afa6aa | [email protected] | Patch |
| https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 | [email protected] | Release Notes |
| https://github.com/Kovah/LinkAce/security/advisories/GHSA-4mxh-7c7f-q79j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linkace linkace | < 2.4.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 25, 2025 | Initial Analysis | [email protected] |
| Nov 5, 2025 | CVE Modified | CISA-ADP |
| Nov 4, 2025 | New CVE Received | [email protected] |