What is the CVSS score of CVE-2026-35516?

CVE-2026-35516 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35516?

Yes, a patch is available for CVE-2026-35516. Update the affected software to the latest version immediately.

Linkace CVE-2026-35516

EUVD-2026-19682 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-07 GitHub_M

SSRF Linkace

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.4

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2026-19682

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:14 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.

AnalysisAI

Server-side request forgery (SSRF) in LinkAce prior to version 2.5.4 allows authenticated users to read responses from internal services by updating links to private IP addresses, exposing cloud credentials and internal service metadata. The links:check cron job executes requests without IP filtering, enabling attackers to probe AWS IMDSv1, cloud metadata endpoints, and internal APIs. The vulnerability requires authentication but operates over the network with low complexity, affecting all installations running versions before 2.5.4. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Technical ContextAI

LinkAce's LinkRepository::update and CheckLinksCommand::checkLink functions perform server-side HTTP requests to validate and check links without validating target IP addresses against private IP ranges (RFC 1918, RFC 5735, link-local, loopback). The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a classic web application flaw where user-controlled input is used in server-initiated requests without proper allowlist or blocklist validation. An authenticated user can initially create a link with a public URL (passing any validation), then update it to target private IPs such as 169.254.169.254 (AWS IMDSv1), 127.0.0.1, or internal service IPs. When the links:check cron job executes periodically, it fetches and processes responses from these internal endpoints server-side, allowing the attacker to read the response content through the application's response handling. This is particularly dangerous in cloud-hosted deployments where metadata services expose temporary credentials and configuration data.

RemediationAI

Upgrade LinkAce to version 2.5.4 or later immediately, as the vendor has released a patched version that implements IP address validation in the LinkRepository::update and CheckLinksCommand::checkLink functions. The fix prevents requests to private IP ranges (RFC 1918, loopback, link-local, and other reserved ranges). After upgrading, verify that the links:check cron job is functioning correctly to ensure the fix is active in your environment. For organizations unable to upgrade immediately, disable or restrict the links:check cron job to prevent server-side requests, and limit link creation/update permissions to trusted users only as a temporary mitigation. Refer to the GitHub security advisory at https://github.com/Kovah/LinkAce/security/advisories/GHSA-4jhm-r4f5-p7xm for comprehensive patch details and additional recommendations.