CVE-2026-35516: linkace

csirt@kutim:~/threat-intel/cve/CVE-2026-35516

CVSS 5.0 · Medium EPSS 0,30%

Kerentanan Server-Side Request Forgery (SSRF) pada linkace. Skor CVSS 3.1 5.0 (Medium) menurut github.com.

Deskripsi (NVD)

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.

Rincian

Terbit di NVD: 7 April 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.0 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 21,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linkace	linkace	Semua versi sebelum 2.5.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Kovah/LinkAce/security/advisories/GHSA-4jhm-r4f5-p7xm exploit · mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.