Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-45344LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances

High 8.1

In plain English

A high-severity injection in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.

Affected products (as reported)

Vendor	Product	Versions
Kovah	LinkAce	< 2.5.6

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-37m5-936h-w455 x_refsource_CONFIRM