High severity7.3NVD Advisory· Published Aug 20, 2026

CVE-2026-49436

Description

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (POST /api/v2/bulk/links) accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Linkace/Linkacellm-create
Range: <2.5.7

Patches

Vulnerability mechanics

References

github.com/Kovah/LinkAce/commit/642ac520347205a8277668bcae269bdc21223eaenvd
github.com/Kovah/LinkAce/security/advisories/GHSA-6r73-pchm-4m39nvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000