CVE-2025-53838: LinkAce Stored XSS Vulnerability

CVE-2025-53838 Overview

CVE-2025-53838 is a stored cross-site scripting (XSS) vulnerability in LinkAce, a self-hosted archive application used to collect and organize website links. The flaw affects all versions prior to 2.1.9 and is tracked under [CWE-79]. Attackers with authenticated access can inject arbitrary JavaScript into the url field of a link. The payload is persisted to the database and executed in a victim's browser when the crafted link is clicked. The issue was addressed in LinkAce version 2.1.9.

Critical Impact
One-click stored XSS allows arbitrary JavaScript execution in a victim's browser session, enabling session hijacking, credential theft, and actions on behalf of the authenticated user.

Affected Products

LinkAce versions prior to 2.1.9
Self-hosted LinkAce deployments across all platforms
Multi-user LinkAce installations where links are shared or publicly visible

Discovery Timeline

2025-09-08 - CVE-2025-53838 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53838

Vulnerability Analysis

LinkAce accepts a URL value when a user creates or updates a link record. The application failed to validate that the submitted value conformed to a URL structure and did not sufficiently escape the value when rendering it inside link attributes. An attacker can submit a crafted payload containing JavaScript as the link's url attribute. The payload is stored in the database and later emitted into the HTML output tied to the clickable link element. When any user clicks the stored link, the browser executes the attacker-controlled script in the context of the LinkAce origin.

Because the attack requires only a single click on a malicious link, exploitation is low friction and well suited to targeting administrators who routinely review submitted content.

Root Cause

The root cause is missing input validation on the url field in LinkUpdateRequest.php. The validation ruleset required the field to be present and unique per user, but did not enforce the Laravel url validation rule. Combined with insufficient output escaping where the stored value was later rendered into link attributes, this allowed JavaScript URI schemes and markup-breaking payloads to persist and execute.

Attack Vector

An authenticated LinkAce user submits a link whose url value is a JavaScript URI or markup containing a script payload. The value passes server-side validation and is stored. When any user — including administrators or other authenticated users — clicks the rendered link, the browser executes the embedded JavaScript under the LinkAce origin. The attacker can then exfiltrate session cookies, call authenticated API endpoints, or modify application data.

php

// Patch: app/Http/Requests/Models/LinkUpdateRequest.php
         if ($this->requireUniqueUrl) {
             $rules['url'] = [
                 'required',
+                'url',
                 Rule::unique('links')->where(fn($query) => $query->where('user_id', auth()->id())),
             ];
         }
// Source: https://github.com/Kovah/LinkAce/commit/4da467a4b0fbb1650670e603f4449b8a47695631

The added 'url' rule forces Laravel's validator to reject any value that is not a syntactically valid URL, blocking javascript: schemes and markup payloads at the request boundary.

Detection Methods for CVE-2025-53838

Indicators of Compromise

Link records whose stored url field begins with javascript:, data:, or contains HTML tags such as <script>, <img, or onerror=
Unexpected outbound requests from browsers of LinkAce users to attacker-controlled domains following link interaction
New or modified link entries created by low-privilege accounts shortly before administrator session anomalies

Detection Strategies

Query the LinkAce links database table for url values that do not begin with http:// or https://
Review web server access logs for POST and PUT requests to link creation and update endpoints that contain encoded <script> or javascript: strings
Monitor browser Content Security Policy (CSP) violation reports if CSP is deployed in front of LinkAce

Monitoring Recommendations

Enable application-level audit logging for link create and update operations, capturing the submitting user and raw payload
Alert on authentication events immediately following link clicks that originate from newly submitted entries
Track LinkAce version strings across self-hosted deployments to identify instances still running versions prior to 2.1.9

How to Mitigate CVE-2025-53838

Immediate Actions Required

Upgrade LinkAce to version 2.1.9 or later on all self-hosted instances
Audit the links table for existing entries containing non-URL url values and remove or sanitize them
Rotate session secrets and force re-authentication for all LinkAce users after upgrading
Restrict link submission to trusted users where feasible until the patch is applied

Patch Information

The vendor fix is delivered in LinkAce 2.1.9 via commit 4da467a4b0fbb1650670e603f4449b8a47695631. The patch adds Laravel's url validation rule to the LinkUpdateRequest validator so non-URL values are rejected before storage. Full details are available in the GitHub Security Advisory GHSA-vwmx-v9qf-q656 and the upstream commit.

Workarounds

Deploy a reverse proxy rule that blocks requests to link endpoints containing javascript: or <script in the url parameter
Enforce a strict Content Security Policy that disallows inline scripts and javascript: URIs on the LinkAce origin
Limit account registration and link submission privileges to a known set of trusted users

bash

# Upgrade LinkAce Docker deployment to the patched release
docker compose pull
docker compose down
docker compose up -d
docker exec -it linkace php artisan migrate --force
docker exec -it linkace php artisan --version