CVE-2026-35516: LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35516?
CVE-2026-35516 has a moderate severity as it allows an authenticated user to perform server-side request forgery (SSRF).
How do I fix CVE-2026-35516?
To fix CVE-2026-35516, update LinkAce to version 2.5.4 or later where the issue has been addressed.
What impacts could CVE-2026-35516 have on my system?
CVE-2026-35516 can potentially allow unauthorized access to read responses from private IP addresses affecting confidentiality.
Which versions of LinkAce are affected by CVE-2026-35516?
CVE-2026-35516 affects LinkAce versions prior to 2.5.4.
Is authentication required to exploit CVE-2026-35516?
Yes, an authenticated user is required to exploit CVE-2026-35516 to perform the SSRF attack.