CVE-2026-110225 Details

A server-side request forgery (SSRF) vulnerability has been identified in Shaarli versions through 0.16.9. This vulnerability allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without proper checks for private addresses. In Shaarli's open mode, which is enabled by setting 'security.open_shaarli=true', this flaw is exposed to all visitors. Attackers can create bookmarks that point to loopback, private, or cloud metadata addresses, triggering the ThumbnailsController's 'ajaxUpdate' method to send blind GET requests to these internal locations.

Shaarli has acknowledged this vulnerability and recommended applying the same 'is_safe_url()' check used in the metadata-fetch path to the thumbnail update route. This would prevent private and reserved URLs from being accessed. Additionally, consider adding a regression test to ensure that bookmarks pointing to reserved addresses do not trigger outbound requests.