PT-2026-24434 · Linkace · Linkace

Kovah · Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-30953

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LinkAce (affected versions not specified)

Description LinkAce is a self-hosted archive for collecting website links. A flaw exists in the link creation process where the server fetches HTML metadata from a URL provided via a POST request to the /links endpoint. The validation rules for LinkStoreRequest do not include a rule to prevent requests to internal network addresses, Docker service hostnames, and cloud metadata endpoints. While a NoPrivateIpRule class exists within the project, it is only applied in FetchController.php and not during the primary link creation process. This could allow an attacker to potentially access internal resources or sensitive information.

Recommendations Apply the NoPrivateIpRule class to the LinkStoreRequest validation rules in the link creation path to prevent requests to internal network addresses, Docker service hostnames, and cloud metadata endpoints.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-30953

GHSA-F2MP-Q78R-7JX7

Affected Products

Linkace

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30953.json · Exploit
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-f2mp-q78r-7jx7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30953 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30953 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031504119517561024 · Twitter Post