Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Lemmy lets low‑privilege users leak internal images

CVE-2026-42181 · published 6 months ago
Summary

Lemmy versions before 0.19.18 let a signed-in user submit a link whose preview image points to an internal server. The system fetches that image and then makes it publicly viewable, exposing internal resources. Upgrade Lemmy to version 0.19.18 or later to stop the image fetching behavior.

What to do
  • Update nutomic lemmy_api_common to version 0.19.18.
Affected software
Ecosystem VendorProductAffected versions
crates.io nutomic lemmy_api_common < 0.19.18
Fix: upgrade to 0.19.18
Original advisory text
Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published8 May 2026
Updated4 Nov 2026
First seen6 May 2026
Sources
GHSA-h6hf-9846-xwrq · OSV
CVE-2026-42181 · NVD
Track software like this
Free during beta