CVE-2026-35516CWE-918

LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

Medium · published April 7, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 22.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-07T15:14Z
EPSS history
Timeline
  • 07 APR 15:14Z
    LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
    cvelistv5