CVE-2026-45344: LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LinkAceto a version that resolves this vulnerability.Fixed in 2.5.6 - Compensating control
If any LinkAce instances are still on versions prior to 2.5.6, restrict network access to the LinkAce setup endpoints so only trusted users can reach them.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45344?
CVE-2026-45344 has a severity score of 8.1, classified as high.
What software is affected by CVE-2026-45344?
CVE-2026-45344 affects LinkAce versions prior to 2.5.6.
How do I fix CVE-2026-45344?
To fix CVE-2026-45344, upgrade your LinkAce installation to version 2.5.6 or later.
What type of vulnerability is CVE-2026-45344?
CVE-2026-45344 is a remote code execution vulnerability due to newline injection in database password setup.
Who can exploit CVE-2026-45344?
A remote attacker with access to the setup endpoint of uninitialized LinkAce instances can exploit CVE-2026-45344.