CVE-2025-55291: Shaarli Bookmark Manager XSS Vulnerability

CVE-2025-55291 Overview

CVE-2025-55291 is a reflected Cross-Site Scripting (XSS) vulnerability in Shaarli, a minimalist bookmark manager and link sharing service. Versions prior to 0.15.0 fail to sanitize the input string rendered on the cloud tag page. Attackers can prematurely close the </title> tag and inject arbitrary HTML or JavaScript into the response. The flaw is tracked under CWE-79 and was fixed in Shaarli 0.15.0. Successful exploitation requires user interaction, typically by enticing a victim to follow a crafted link.

Critical Impact
Reflected XSS in the Shaarli tag cloud allows attackers to execute arbitrary script in a victim's browser session, leading to account takeover or theft of stored bookmarks.

Affected Products

Shaarli versions prior to 0.15.0
Component: application/front/controller/visitor/TagCloudController.php
Fixed release: Shaarli 0.15.0

Discovery Timeline

2025-08-18 - CVE CVE-2025-55291 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-55291

Vulnerability Analysis

The vulnerability resides in Shaarli's tag cloud controller, which renders user-supplied search tag input directly into the HTML <title> element of the page. Because the searchTags value is concatenated into the page title without HTML escaping, an attacker who supplies a payload containing </title> can break out of the title context. Once outside the title element, the attacker can inject arbitrary HTML markup, including <script> tags or event-handler attributes that execute JavaScript in the victim's browser.

The issue is a classic output-encoding failure rather than a logic flaw. Shaarli's template assignment trusted the raw request parameter, allowing reflected content to alter the document structure. Exploitation requires the victim to load a crafted URL pointing at the tag cloud endpoint with the malicious searchtags parameter, classifying the issue as a reflected XSS that requires user interaction.

Root Cause

The assignView('pagetitle', ...) call in TagCloudController.php passed the user-controlled $searchTags value directly into the template variable without invoking Shaarli's escape() helper. The fix applies escape($searchTags) before assignment, ensuring the data is HTML-encoded before rendering inside the <title> element.

Attack Vector

An attacker crafts a URL targeting the Shaarli tag cloud page with a searchtags value containing </title> followed by injected HTML or JavaScript. When a logged-in user visits the link, the unescaped payload is reflected into the rendered page and executed in the browser context of the Shaarli instance, allowing session theft, CSRF chaining, or content manipulation.

php

// Patch in application/front/controller/visitor/TagCloudController.php
$searchTags = !empty($searchTags) ? trim(str_replace($tagsSeparator, ' ', $searchTags)) . ' - ' : '';
$this->assignView(
    'pagetitle',
-   $searchTags . t('Tag ' . $type) . ' - ' . $this->container->conf->get('general.title', 'Shaarli')
+   escape($searchTags) . t('Tag ' . $type) . ' - ' . $this->container->conf->get('general.title', 'Shaarli')
);

return $response->write($this->render('tag.' . $type));

Source: Shaarli commit 66faa61 — the patch replaces the raw $searchTags concatenation with an HTML-escaped value.

Detection Methods for CVE-2025-55291

Indicators of Compromise

HTTP GET requests to the Shaarli tag cloud or tag list endpoints containing </title>, <script, or onerror= substrings inside the searchtags parameter.
Web server access logs showing URL-encoded sequences such as %3C%2Ftitle%3E or %3Cscript%3E targeting /?do=tagcloud or /?do=taglist.
Outbound requests from authenticated user browsers to attacker-controlled domains shortly after visiting a Shaarli URL.

Detection Strategies

Inspect web access logs for tag cloud requests carrying HTML control characters in query parameters and alert on matches.
Deploy a Web Application Firewall (WAF) rule that blocks reflected payloads containing </title> or <script directed at Shaarli endpoints.
Review Shaarli version banners across the estate and flag any instance running a version below 0.15.0.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to surface inline script execution attempts originating from Shaarli pages.
Forward Shaarli HTTP logs to a centralized analytics platform and build queries that correlate suspicious searchtags values with downstream authentication or session events.
Track referrer headers on authenticated administrative actions to identify session use that follows external link clicks.

How to Mitigate CVE-2025-55291

Immediate Actions Required

Upgrade all Shaarli installations to version 0.15.0 or later, which contains the escape() fix in TagCloudController.php.
Audit user accounts and revoke active sessions for administrators who may have followed untrusted links to the affected instance.
Restrict network exposure of Shaarli instances that cannot be patched immediately by placing them behind authenticated reverse proxies.

Patch Information

The vendor fix is published in Shaarli commit 66faa61 and documented in GitHub Security Advisory GHSA-7w7w-pw4j-265h. The patch wraps the $searchTags value in Shaarli's escape() helper before it is assigned to the pagetitle template variable, preventing breakout from the <title> element.

Workarounds

Block requests to /?do=tagcloud and /?do=taglist containing <, >, or URL-encoded equivalents at the reverse proxy or WAF layer until the upgrade is applied.
Enforce a strict Content Security Policy that disallows inline script execution to limit the impact of reflected payloads.
Require authenticated access to the tag cloud endpoint and disable anonymous browsing where the deployment permits.

bash

# Example nginx rule to block reflected payloads against Shaarli tag endpoints
location ~* /?do=(tagcloud|taglist) {
    if ($args ~* "(%3C|<)(/?title|script)") {
        return 403;
    }
    proxy_pass http://shaarli_backend;
}