CVE-2026-45344CWE-74

LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances

High · published May 28, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00769 · 55.1th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-05-28T20:41Z
EPSS history
Timeline
  • 28 MAY 20:41Z
    LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
    cvelistv5