CVE-2026-35516mediumCWE-918

CVE-2026-35516: fallo de gravedad media en Kovah LinkAce

LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LinkAce

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5epss 0.3%
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Productos afectados
Kovah · LinkAce
CVEs relacionadas — Kovah LinkAce

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-45344HIGHLinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instancesEPSS 0.5%CVE-2024-56508HIGHFile Upload Vulnerability Leading to XSS in LinkAce v1.15.5EPSS 0.4%CVE-2025-62720HIGHLinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private LinksEPSS 0.4%CVE-2025-62721HIGHLinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and TagsEPSS 0.4%CVE-2026-49436HIGHLinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link APIEPSS 0.4%CVE-2025-59424HIGHLinkAce Vulnerable to Stored XSS on the Audit PageEPSS 0.4%