CVE-2026-45344: high-severity vulnerability in Kovah LinkAce
LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.5%
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Kovah · LinkAceRelated CVEs — Kovah LinkAce
In the same product, most dangerous first.
CVE-2024-56508HIGHFile Upload Vulnerability Leading to XSS in LinkAce v1.15.5EPSS 0.4%CVE-2025-62720HIGHLinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private LinksEPSS 0.4%CVE-2025-62721HIGHLinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and TagsEPSS 0.4%CVE-2026-49436HIGHLinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link APIEPSS 0.4%CVE-2025-59424HIGHLinkAce Vulnerable to Stored XSS on the Audit PageEPSS 0.4%CVE-2025-62719LOWLinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching FunctionalityEPSS 0.3%