Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but the audited code path does not reject loopback, private, or link-local destinations before the Webmention request is issued. This lets a normal user trigger server-side HTTP requests toward internal services. Details The entry point is the normal post creation API. The user-controlled url field is accepted, normalized with dieselurlcreate(), and only validated with isvalidurl(). That validation allows http and https but does not implement internal address rejection. The post creation flow then schedules Webmention delivery for public communities. This creates a direct source-to-sink path from an externally supplied post URL to a server-side outbound HTTP request. Core vulnerable code path:…
Recommended action: Upgrade to 0.19.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. Details The metadata fetch logic applies an internal-address check only to the initial post URL. After HTML parsing, extractopengraphdata() accepts absolute og:image values and returns them as-is. Later, generatepostlinkmetadata() passes that second-hop image URL into generatepictrsthumbnail(), which instructs local pict-rs to fetch it through image/download?url=.... This creates a two-stage source-to-sink chain where the…
Recommended action: Upgrade to 0.19.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.