Server-Side Request Forgery Vulnerability in Lemmy Forum by LemmyNet

CVE-2025-25194

What is CVE-2025-25194?

Lemmy, an innovative link aggregator and forum platform, is susceptible to a server-side request forgery due to its reliance on the activitypub_federation framework. This security flaw allows attackers to circumvent predefined hardcoded URL paths and mechanisms designed to prevent unauthorized local requests. Specifically, users can exploit this vulnerability to send arbitrary GET requests to any server, exposing sensitive information and potentially manipulating remote services. As of now, no patch has been released to address this issue.

References