PT-2026-37169 · Lemmy · Lemmy

Nutomic · Published 2026-04-24 · Updated 2026-05-13 · CVE-2026-42180

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.18

Description An authenticated low-privileged user can trigger server-side HTTP requests toward internal services. This occurs when a user creates a link post in a public community via the "POST /api/v3/post" endpoint. The backend asynchronously sends a Webmention to the target link, but the system fails to reject loopback, private, or link-local destinations. The url variable is validated for syntax and scheme using the is valid url() function, but it does not implement internal address rejection, allowing the application server to be used as a blind Server-Side Request Forgery (SSRF) primitive. SSRF is a flaw where an attacker can force a server to make requests to an unintended location, often bypassing network security controls to reach internal systems.

Recommendations Update to version 0.19.18.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42180

GHSA-3JVJ-V6W2-H948

Affected Products

Lemmy

References · 10

• 🔥 https://github.com/LemmyNet/lemmy/security/advisories/GHSA-3jvj-v6w2-h948 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42180 · Security Note
• https://osv.dev/vulnerability/GHSA-3jvj-v6w2-h948 · Vendor Advisory
• https://github.com/LemmyNet/lemmy · Note
• https://github.com/LemmyNet/lemmy/releases/tag/0.19.18 · Note
• https://github.com/LemmyNet/lemmy/commit/1f06693b708020c5c3a3752bd2f1c6006a75e9bc · Note
• https://t.me/cveNotify/163348 · Telegram Post
• https://t.me/CVEtracker/53157 · Telegram Post
• https://twitter.com/CVEnew/status/2053131448081850871 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052865646547939576 · Twitter Post