CVE-2026-42455: Linkwarden Archive Upload XSS Vulnerability

CVE-2026-42455 Overview

Linkwarden is a self-hosted, open-source collaborative bookmark manager used to collect, organize, and archive webpages. CVE-2026-42455 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Linkwarden versions 2.14.0 and prior. The archive upload endpoint POST /api/v1/archives/[linkId]?format=4 accepts HTML files without sanitizing embedded JavaScript. When the archive is later retrieved via GET /api/v1/archives/[linkId]?format=4, the server returns the content with Content-Type: text/html from the Linkwarden origin and without a Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of the authenticated Linkwarden session.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim sessions, leading to account takeover, data theft, and unauthorized actions within Linkwarden.

Affected Products

Linkwarden versions 2.14.0 and prior
Self-hosted Linkwarden deployments
Any instance exposing the archive upload endpoint to authenticated users

Discovery Timeline

2026-05-09 - CVE-2026-42455 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42455

Vulnerability Analysis

The vulnerability resides in Linkwarden's archive handling pipeline. The endpoint POST /api/v1/archives/[linkId]?format=4 accepts user-supplied HTML files with the text/html MIME type. The server stores these files without sanitizing or stripping embedded <script> tags, inline event handlers, or other JavaScript execution sinks.

When a user retrieves the archive through GET /api/v1/archives/[linkId]?format=4, the application returns the file directly with Content-Type: text/html. The response is served from the Linkwarden origin, placing executed scripts within the same security context as the authenticated user session. The absence of a Content-Security-Policy (CSP) header removes a key defensive layer that would otherwise restrict inline script execution.

Root Cause

The root cause is missing input sanitization on uploaded HTML archives combined with the absence of a Content-Security-Policy header on archive responses. The application trusts user-uploaded HTML content and serves it from the same origin as the authenticated application interface, breaking the security boundary between user data and application logic.

Attack Vector

An authenticated user uploads a malicious HTML archive containing JavaScript payloads to the archive endpoint. The attacker then shares the link or convinces another authenticated user to view the archive. When the victim's browser renders the response, the injected JavaScript executes with access to the victim's session cookies, local storage, and application state. The attacker can exfiltrate bookmarks, modify account settings, or pivot to other authenticated actions. See the GitHub Security Advisory GHSA-fjvg-mch3-j3vg for additional technical details.

Detection Methods for CVE-2026-42455

Indicators of Compromise

HTTP POST requests to /api/v1/archives/[linkId]?format=4 with Content-Type: text/html payloads containing <script> tags or inline event handlers
Archive files in Linkwarden storage containing JavaScript constructs such as eval(, document.cookie, or fetch( calls to external domains
Outbound network connections from user browsers to unfamiliar domains shortly after accessing Linkwarden archive URLs

Detection Strategies

Inspect uploaded archive files for HTML content containing executable JavaScript before serving to clients
Monitor web server access logs for repeated archive uploads followed by access requests from multiple distinct sessions
Deploy web application firewall rules to flag HTML uploads containing <script>, onerror=, or onload= patterns to the archive endpoint

Monitoring Recommendations

Enable verbose request logging on the /api/v1/archives/ endpoint family and retain logs for forensic review
Alert on responses from Linkwarden lacking a Content-Security-Policy header for HTML content types
Track session anomalies such as unexpected API calls originating from browser sessions immediately after archive views

How to Mitigate CVE-2026-42455

Immediate Actions Required

Restrict access to Linkwarden instances to trusted users until a patch is available, since exploitation requires authenticated upload access
Disable or block the archive upload endpoint at the reverse proxy layer if archive functionality is non-essential
Audit existing archives for HTML files containing JavaScript and remove suspicious entries

Patch Information

At the time of publication, no official patches are available from the Linkwarden project. Monitor the GitHub Security Advisory GHSA-fjvg-mch3-j3vg for patch release announcements and upgrade as soon as a fixed version is published.

Workarounds

Configure the reverse proxy (nginx, Caddy, Traefik) to inject a strict Content-Security-Policy header on archive responses, such as default-src 'none'; sandbox;
Force the Content-Disposition: attachment header on archive responses to prevent inline rendering in browsers
Serve archives from a separate sandboxed domain or subdomain isolated from the authenticated Linkwarden origin
Limit archive uploads to non-HTML formats by filtering on MIME type at the proxy layer

bash

# Example nginx configuration to enforce CSP and force download on archive responses
location ~ ^/api/v1/archives/ {
    add_header Content-Security-Policy "default-src 'none'; sandbox;" always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://linkwarden_backend;
}