What is the CVSS score of CVE-2026-45344?

CVE-2026-45344 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of LinkAce are affected by CVE-2026-45344?

LinkAce self-hosted deployments running versions prior to 2.5.6 are exposed to unauthenticated remote code execution during initial system configuration, allowing attackers to inject arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-45344?

Within 24 hours: Audit all LinkAce deployments to identify running versions and setup completion status; restrict network access to instances with incomplete setup. Within 7 days: Upgrade all LinkAce instances to version 2.5.6 or later and complete the setup wizard. Within 30 days: Implement network-level access controls limiting setup endpoints to trusted networks and deploy monitoring for .env file modifications.

LinkAce CVE-2026-45344

EUVD-2026-33054 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-28 GitHub_M

Code Injection Linkace

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 28, 2026 - 23:02 EUVD

Analysis Generated

May 28, 2026 - 21:51 vuln.today

DescriptionGitHub Advisory

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.

AnalysisAI

Remote code execution in LinkAce self-hosted link archive versions prior to 2.5.6 allows unauthenticated remote attackers to inject arbitrary mail configuration variables into the application's .env file via the initial setup database configuration flow, leading to command execution when the application subsequently sends mail. The flaw, classified as CWE-74 injection, affects instances that have not yet completed the setup wizard and carries a CVSS 8.1 (High). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

LinkAce is a PHP-based self-hosted bookmark/link archiving application by Kovah, identified by CPE cpe:2.3:a:kovah:linkace:*:*:*:*:*:*:*:*. Like many Laravel-style apps, it stores runtime configuration (including DB and mail settings) in a .env file that is parsed at boot. The vulnerability is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) - user-supplied values from the setup wizard's database-credential form are written verbatim into .env without escaping newline or delimiter characters, allowing an attacker to break out of the intended variable assignment and append additional configuration directives. By controlling MAIL_* variables (for example pointing MAIL_DRIVER to sendmail or injecting a malicious MAIL_PATH/transport argument), the attacker turns a later mail-send operation into a command-execution sink, a known Laravel/Symfony Mailer abuse pattern.

RemediationAI

Vendor-released patch: upgrade LinkAce to 2.5.6 or later, as specified in the GitHub Security Advisory GHSA-37m5-936h-w455 (https://github.com/Kovah/LinkAce/security/advisories/GHSA-37m5-936h-w455). For operators who cannot immediately upgrade, the most effective compensating control is to ensure setup is completed in a trusted environment before the instance is exposed to untrusted networks - provision LinkAce behind an authenticated reverse proxy or on a private network until the .env is finalized, then expose it. As a network-level mitigation, restrict access to the setup endpoints (the /setup routes used during initial database configuration) via reverse-proxy ACLs or firewall rules so only administrative IPs can reach them; the trade-off is that legitimate first-time setup must be performed from those allow-listed sources. Avoid re-triggering the setup flow on an already-deployed instance, and after upgrading, audit the .env file for unexpected MAIL_* or other variables that may indicate prior tampering.