Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M
CVE-2026-35516LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
Medium 5.0
In plain English
A medium-severity server-side request forgery in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/Kovah/LinkAce/security/advisories/GHSA-4jhm-r4f5-p7xm x_refsource_CONFIRM