Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42455LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)

High 8.8

In plain English

A high-severity cross-site scripting in linkwarden from linkwarden. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files (text/html) without sanitizing JavaScript content. When the archive is later accessed via GET /api/v1/archives/[linkId]?format=4, the HTML is served with Content-Type: text/html from the Linkwarden origin, without any Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of the authenticated Linkwarden sessio. At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
linkwarden	linkwarden	<= 2.14.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/linkwarden/linkwarden/security/advisories/GHSA-fjvg-mch3-j3vg x_refsource_CONFIRM