Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-33953LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce

High 8.5

In plain English

A high-severity server-side request forgery in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side requests to internal services reachable by the LinkAce server but not directly reachable by an external user. Version 2.5.3 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
Kovah	LinkAce	< 2.5.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-wp4g-qw9j-wfjg x_refsource_CONFIRM