CVE-2026-33953

Description

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side requests to internal services reachable by the LinkAce server but not directly reachable by an external user. Version 2.5.3 patches the issue.

PUBLISHED Reserved 2026-03-24 | Published 2026-03-27 | Updated 2026-03-30 | Assigner GitHub_M

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

Product status

References

github.com/...inkAce/security/advisories/GHSA-wp4g-qw9j-wfjg

cve.org (CVE-2026-33953)

nvd.nist.gov (CVE-2026-33953)

Download JSON