CVE-2025-49588: Linkwarden Local File Inclusion Vulnerability

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-02 · updated 2026-10-19
Weakness: CWE-73

Description

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.

Affected products

linkwarden: = 2.10.2

References

https://github.com/linkwarden/linkwarden/security/advisories/GHSA-rfc2-x8hr-536q
https://github.com/linkwarden/linkwarden/security/advisories/GHSA-rfc2-x8hr-536q

Get alerted when CVE-2025-49588 or the next vulnerability affects your stack