Threat Intelligence Database

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.

CVE-2026-7502 is an authorization bypass vulnerability in LinkStackOrg LinkStack versions up to 4.8.6. The flaw exists in the saveLink function within the UserController.php file of the Management Endpoint component. This vulnerability can be exploited remotely without user interaction and allows an attacker with limited privileges to bypass authorization controls. A public exploit disclosure exists, but no official fix has yet been released, although a pull request for a fix is pending acceptance. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

A cross-site scripting (XSS) vulnerability exists in LinkStackOrg LinkStack versions up to 4.8.6 in the editPage function of UserController.php. The vulnerability arises from improper handling of the pageDescription argument, allowing remote attackers to inject malicious scripts. Although an exploit is publicly available, the vendor has not yet issued a fix or official remediation. The vulnerability has a medium severity rating with a CVSS score of 5.1.