Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

lemmy_routes

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7crates.ioPublished

    Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

    CVE-2026-29178 · GHSA-jvxv-2jjp-jxc3

    Affected
    • crates.io lemmy_routes <= 0.19.15
    Fixed in
    0.19.16· Vendor fix available
    Issue
    The GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the filetype query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. Affected code crates/routes/src/images/download.rs, lines 17-40 (getimage function): The filetype parameter (ImageGetParams.filetype: Option<String) is directly interpolated into the URL string without any validation or encoding. Since pict-rs's /image/process.{ext} endpoint supports a ?proxy={url} parameter for fetching remote images, an attacker can inject ?proxy=... via filetype to make pict-rs fetch arbitrary URLs. This endpoint does not require authentication (no LocalUserView extractor). PoC The response from the internal URL is streamed back to the attacker through pict-rs and Lemmy. Impact An unauthenticated attacker can: - Access cloud metadata services (AWS/GCP/Azure…

    Recommended action: Upgrade to 0.19.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →