Server-Side Request Forgery Vulnerability in Lemmy by LemmyNet
CVE-2026-29178

7.7HIGH

Key Information:

Vendor

Lemmynet

Status
Lemmy
Vendor
CVE Published:
6 March 2026

What is CVE-2026-29178?

Lemmy, a popular link aggregator within the fediverse, is exposed to a server-side request forgery (SSRF) vulnerability due to its reliance on the activitypub_federation framework. Specifically, the endpoint GET /api/v4/image/{filename} lacks proper validation for the file_type query parameter, allowing attackers to inject arbitrary query parameters. This exploit enables attackers to manipulate internal requests to the pict-rs service, which can then be coerced into fetching data from arbitrary URLs. This flaw was identified and has been addressed in version 0.19.16.

Affected Version(s)

lemmy < 0.19.16

References

https://github.com/LemmyNet/lemmy/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/LemmyNet/lemmy/commit/f47a03f56d1797bc...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.