Description
LinkAce is a self-hosted archive to collect website links. Versions 2.4.2 and below have a Stored Cross-site Scripting vulnerability through the Atom feed endpoint for lists (/lists/feed). An authenticated user can inject a CDATA-breaking payload into a list description that escapes the XML CDATA section, injects a native SVG element into the Atom XML document, and executes arbitrary JavaScript directly in the browser when the feed URL is visited. No RSS reader or additional rendering context is required — the browser's native XML parser processes the injected SVG and fires the onload event handler. This vulnerability exists because the lists feed template outputs list descriptions using Blade's raw syntax ({!! !!}) without sanitization inside a CDATA block. The critical detail is that because the output sits inside <![CDATA[...]]>, an attacker can inject the sequence ]]> to close the CDATA section prematurely, then inject arbitrary XML/SVG elements that the browser parses and executes natively as part of the Atom document. This issue has been fixed in version 2.4.3.
INFO
Published Date :
2026-02-21T06:54:41.308Z
Last Modified :
2026-02-24T18:55:40.498Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-27458 vulnerability.
| Vendors | Products |
|---|---|
| Kovah |
|
| Linkace |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27458.
