PT-2026-30864 · Kovah · Linkace
Published
2026-04-07
·
Updated
2026-04-07
·
CVE-2026-35516
CVSS v3.1
5.0
Medium
| AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linkace