CVE-2025-62719: LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality
LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts user-provided URLs and makes HTTP requests to them without validating that the destination is not an internal or private network resource. This Server-Side Request Forgery (SSRF) vulnerability allows authenticated attackers to use the application server to perform port scanning and service discovery on internal networks. Practical impact is very limited because the function only extracts content from HTML meta keywords tags, which prevents meaningful data exfiltration from databases, APIs, or cloud metadata endpoints. This issue is fixed in version 2.4.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62719?
CVE-2025-62719 has been assigned a vulnerability severity that indicates risk levels depending on potential impact and exploitability.
How do I fix CVE-2025-62719?
To fix CVE-2025-62719, upgrade LinkAce to version 2.4.0 or later, which addresses the issue.
What versions of LinkAce are affected by CVE-2025-62719?
CVE-2025-62719 affects LinkAce versions 2.3.0 and below.
What type of vulnerability is CVE-2025-62719?
CVE-2025-62719 is a security vulnerability related to improper URL validation in the FetchController class.
Can CVE-2025-62719 lead to data exposure?
Yes, CVE-2025-62719 can potentially lead to data exposure by allowing users to submit URLs that access internal or private networks.