Description

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-20T22:17:20.240Z",
  "pubdate": "2026-08-20T22:17:20.240Z",
  "executiveSummary": "LinkAce prior to version 2.5.7 contains a Stored Cross-Site Scripting vulnerability within the Bulk Link API endpoint. The vulnerability allows an authenticated user to submit and store arbitrary JavaScript URIs without format validation. When rendered verbatim within Blade templates as an href attribute, clicking the malicious link executes arbitrary JavaScript in the context of a victim's browser session. This enables the exfiltration of sensitive session tokens, authentication cookies, and unauthorized interaction with the application. Exploitation requires authentication to the platform and the ability to interact with the affected API endpoint and rendered user interface.",
  "technicalDetails": "The vulnerability resides in the Bulk Link API endpoint located at POST /api/v2/bulk/links within LinkAce prior to version 2.5.7. The root cause is the lack of proper input validation and URI scheme sanitization when processing incoming link submissions. Specifically, the application permits the acceptance and database persistence of non-standard or executable URI schemes, such as javascript:, instead of enforcing strict validation against authorized protocols like http:// or https://. The vulnerable component involves both the API input handling mechanism and the subsequent presentation layer, which utilizes Blade templates to render the stored URLs verbatim inside HTML href attributes without context-aware output encoding or sanitization. The attack flow proceeds as follows: First, an authenticated attacker crafts a payload utilizing the javascript: URI scheme containing arbitrary JavaScript instructions designed to access document.cookie or session storage. Second, the attacker sends this payload to the vulnerable POST /api/v2/bulk/links endpoint. The application accepts the input and stores the malicious URI in the database without validation. Third, when a victimized user accesses the interface and clicks the rendered link containing the stored payload, the browser interprets the javascript: protocol handler rather than navigating to a remote web resource. Fourth, the arbitrary JavaScript executes within the security context of the victim's authenticated session. The post-exploitation impact includes complete session hijacking via cookie exfiltration, unauthorized administrative actions performed on behalf of the victim, and potential compromise of the self-hosted archive environment. Authentication is required to interact with the API endpoint, and network exposure is inherent to the web application deployment."
}