CVE-2025-59424: LinkAce Stored XSS Vulnerability

CVE-2025-59424 Overview

LinkAce is a self-hosted archive application for collecting and organizing website links. CVE-2025-59424 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting LinkAce versions prior to 2.3.1. The flaw resides in the /system/audit page, where the application fails to sanitize the username field before rendering it in the audit log. An authenticated attacker can set a malicious JavaScript payload as their username, which executes in the browser of any user who views the audit log page. This vulnerability is fixed in version 2.3.1.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in administrator browsers viewing the audit log, leading to session hijacking and account takeover.

Affected Products

LinkAce versions prior to 2.3.1
Self-hosted LinkAce instances exposed to multiple authenticated users
Deployments where administrators access /system/audit

Discovery Timeline

2025-09-18 - CVE-2025-59424 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59424

Vulnerability Analysis

The vulnerability stems from improper output encoding in the audit log rendering logic. LinkAce records user actions such as API token generation and revocation in an audit trail accessible at /system/audit. The application stores the actor's username alongside each event and renders it directly into HTML when an administrator views the log. Because the username field is not sanitized or escaped, any HTML or JavaScript embedded in the username persists in the database and executes when rendered.

The attack requires an authenticated account but no elevated privileges. An attacker only needs the ability to set their own username and trigger any logged action. The payload then waits passively until a higher-privileged user views the audit page.

Root Cause

The root cause is missing output encoding of user-controlled data, classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. The username field is treated as trusted data when rendered into the audit log template, despite being attacker-controlled at account creation or profile update time.

Attack Vector

An attacker registers or updates an account with a username containing a JavaScript payload such as a <script> tag or an event handler attribute. The attacker then performs any auditable action, such as generating or revoking an API token, which persists the malicious username in the audit log entry. When an administrator navigates to /system/audit, the browser parses and executes the stored payload in the administrator's session context. This enables session token theft, forced administrative actions via authenticated requests, and full account takeover.

For exploitation specifics, see the GitHub Security Advisory GHSA-289g-9gff-p4wh.

Detection Methods for CVE-2025-59424

Indicators of Compromise

Usernames in the LinkAce user table containing HTML tags, <script> elements, or on* event handler attributes
Audit log entries at /system/audit referencing accounts with anomalous or non-printable username characters
Unexpected outbound requests from administrator browsers shortly after viewing the audit page
Unauthorized API token generation or revocation events recorded against administrator accounts

Detection Strategies

Query the LinkAce user database for usernames matching patterns such as <, >, script, onerror, or onload
Review audit log records created before upgrading to 2.3.1 for suspicious actor names
Inspect web server access logs for /system/audit requests followed by unusual outbound traffic from the same client IP

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting and monitor for violations originating from /system/audit
Alert on creation or modification of LinkAce accounts where the username contains non-alphanumeric characters
Track API token lifecycle events and correlate them with the acting username for anomalies

How to Mitigate CVE-2025-59424

Immediate Actions Required

Upgrade LinkAce to version 2.3.1 or later, which contains the official fix
Audit existing usernames in the database and rename or remove any containing HTML or script syntax
Purge or sanitize historical audit log entries that contain malicious payloads before allowing administrators to view the page
Rotate API tokens and administrator session cookies if compromise is suspected

Patch Information

The vendor released the fix in LinkAce 2.3.1. The corrective change is published in the GitHub Commit c0d21b9, which adds proper output encoding for the username field rendered in the audit log. Full advisory details are available in the GitHub Security Advisory GHSA-289g-9gff-p4wh.

Workarounds

Restrict access to /system/audit to a trusted network segment or via reverse proxy authentication until patching is complete
Enforce a strict username validation policy that rejects non-alphanumeric characters at registration and profile update
Deploy a Content Security Policy header that disallows inline script execution on LinkAce pages

bash

# Example nginx CSP header to mitigate inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;