What is the CVSS score of CVE-2026-33953?

CVE-2026-33953 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Linkace are affected by CVE-2026-33953?

LinkAce self-hosted link archival application versions prior to 2.5.3 contain a server-side request forgery (SSRF) vulnerability that allows any authenticated user to bypass network controls and…. A patch is available.

How to fix or mitigate CVE-2026-33953?

Within 24 hours: inventory all LinkAce deployments and document current version numbers and internal network exposure. Within 7 days: upgrade all instances to LinkAce version 2.5.3 or later and validate successful patching. Within 30 days: review access logs for suspicious internal-resource queries, audit authenticated user account privileges, and implement network-level monitoring for SSRF patterns (DNS rebinding attempts, internal IP ranges in HTTP requests).

Linkace CVE-2026-33953

EUVD-2026-16868 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-27 GitHub_M

SSRF Linkace

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:11 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.3

EUVD ID Assigned

Mar 27, 2026 - 22:00 euvd

EUVD-2026-16868

Analysis Generated

Mar 27, 2026 - 22:00 vuln.today

CVE Published

Mar 27, 2026 - 21:22 nvd

HIGH 8.5

DescriptionGitHub Advisory

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side requests to internal services reachable by the LinkAce server but not directly reachable by an external user. Version 2.5.3 patches the issue.

AnalysisAI

Server-Side Request Forgery (SSRF) in LinkAce self-hosted link archival application allows authenticated users to bypass IP-based blocklist protections and access internal-only resources through hostname resolution. Attackers with low-privilege accounts can leverage this to probe internal network services, exfiltrate sensitive data from internal APIs, or pivot to otherwise unreachable infrastructure. CVSS 8.5 (High) with cross-scope impact reflects the potential for lateral movement beyond the application boundary. No active exploitation confirmed (CISA KEV: not listed), but the vulnerability class (CWE-918 SSRF) is commonly exploited when accessible to authenticated users. Patch available in version 2.5.3.

Technical ContextAI

LinkAce is a self-hosted PHP-based web application for archiving and organizing website links, identified by CPE cpe:2.3:a:kovah:linkace. The vulnerability stems from incomplete Server-Side Request Forgery (SSRF) protections classified as CWE-918 (Server-Side Request Forgery). While the application implements IP literal blocklisting to prevent direct requests to private IP ranges (RFC 1918 addresses like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), it fails to validate hostnames that resolve to internal addresses. When an authenticated user submits a URL with an internal hostname (e.g., internal-api.local, metadata.internal), the server performs DNS resolution and issues HTTP requests without re-validating the resolved IP against the blocklist. This Time-of-Check-Time-of-Use (TOCTOU) weakness allows bypass of perimeter controls through DNS rebinding or internal DNS entries, a common SSRF evasion technique targeting applications that only filter at the URL parsing stage rather than at connection establishment.

RemediationAI

Vendor-released patch: Version 2.5.3 resolves the SSRF vulnerability through enhanced hostname validation and IP resolution checks. Administrators should immediately upgrade all LinkAce installations to version 2.5.3 or later by following the update procedures documented in the project repository. The patch implements pre-connection IP validation to ensure resolved hostnames do not point to private IP ranges, closing the hostname-based bypass vector. For environments unable to immediately upgrade, implement network-level controls as temporary mitigations: configure egress filtering on the LinkAce server to block outbound connections to RFC 1918 private address spaces, localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata service endpoints (169.254.169.254 for AWS/Azure). Additionally, restrict authenticated user account creation and audit existing user accounts for suspicious link submissions targeting internal hostnames. Review application logs for URL patterns containing internal domain suffixes or non-routable TLDs. Full remediation details and upgrade instructions are available in the GitHub Security Advisory at https://github.com/Kovah/LinkAce/security/advisories/GHSA-wp4g-qw9j-wfjg.