PT-2026-24434 · Linkace · Linkace

Kovah · Publicado 2026-03-10 · Atualizado 2026-03-10 · CVE-2026-30953

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LinkAce (affected versions not specified)

Description LinkAce is a self-hosted archive for collecting website links. A flaw exists in the link creation process where the server fetches HTML metadata from a URL provided via a POST request to the /links endpoint. The validation rules for LinkStoreRequest do not include a rule to prevent requests to internal network addresses, Docker service hostnames, and cloud metadata endpoints. While a NoPrivateIpRule class exists within the project, it is only applied in FetchController.php and not during the primary link creation process. This could allow an attacker to potentially access internal resources or sensitive information.

Recommendations Apply the NoPrivateIpRule class to the LinkStoreRequest validation rules in the link creation path to prevent requests to internal network addresses, Docker service hostnames, and cloud metadata endpoints.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-30953

GHSA-F2MP-Q78R-7JX7

Produtos afetados

Linkace

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30953.json · Exploit
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-f2mp-q78r-7jx7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30953 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031504119517561024 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30953 · Aviso do Fabricante