CVE-2026-29178: falha de alta gravidade em LemmyNet lemmy
Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.3%
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
LemmyNet · lemmyCVEs relacionadas — LemmyNet lemmy
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54739MEDIUMLemmy: Login Endpoint User Enumeration via HTTP Response Code DifferentialEPSS 0.6%CVE-2026-54738MEDIUMLemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfoEPSS 0.6%CVE-2026-54742MEDIUMLemmy: `CollectionAdd::Featured` does not check the post is in the communityEPSS 0.5%CVE-2026-54743MEDIUMLemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embedEPSS 0.5%CVE-2024-23649HIGHAny authenticated user may obtain private message details from other users on the same instanceEPSS 0.5%CVE-2026-54741MEDIUMLemmy: Blocked users can edit private messages sent before the blockEPSS 0.5%