Description

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.

INFO

Published Date :

2026-04-07T15:14:45.891Z

Last Modified :

2026-04-09T14:36:27.061Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-35516 vulnerability.

Vendors Products
Kovah
  • Linkace
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-35516.

URL Resource
https://github.com/Kovah/LinkAce/security/advisories/GHSA-4jhm-r4f5-p7xm cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact