CVE-2026-42181

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42181", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T01:53:21.582Z", "datePublished": "2026-05-08T19:26:07.763Z", "dateUpdated": "2026-05-11T16:01:01.124Z"}, "containers": {"cna": {"title": "Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq"}, {"name": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.18"}], "affected": [{"vendor": "LemmyNet", "product": "lemmy", "versions": [{"version": "< 0.19.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T19:26:07.763Z"}, "descriptions": [{"lang": "en", "value": "Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18."}], "source": {"advisory": "GHSA-h6hf-9846-xwrq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T16:00:57.536211Z", "id": "CVE-2026-42181", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T16:01:01.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42181", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T16:00:57.536211Z"}}}], "references": [{"url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T16:00:51.932Z"}}], "cna": {"title": "Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image", "source": {"advisory": "GHSA-h6hf-9846-xwrq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "LemmyNet", "product": "lemmy", "versions": [{"status": "affected", "version": "< 0.19.18"}]}], "references": [{"url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq", "name": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.18", "name": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.18", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T19:26:07.763Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42181", "state": "PUBLISHED", "dateUpdated": "2026-05-11T16:01:01.124Z", "dateReserved": "2026-04-25T01:53:21.582Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T19:26:07.763Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lemmy", "vendor": "LemmyNet", "versions": [{"status": "affected", "version": "< 0.19.18"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18."}, {"lang": "es", "value": "Lemmy es un agregador de enlaces y un foro para el fediverso. Antes de la versi\u00f3n 0.19.18, Lemmy obtiene metadatos para las URL de publicaciones proporcionadas por el usuario y, bajo el modo de imagen predeterminado StoreLinkPreviews, descarga la imagen de vista previa a trav\u00e9s de pict-rs local. Mientras que la URL de la p\u00e1gina de nivel superior se verifica contra rangos de IP internos, la URL og:image extra\u00edda no est\u00e1 sujeta a la misma restricci\u00f3n. Como resultado, un usuario autenticado con bajos privilegios puede enviar una p\u00e1gina p\u00fablica controlada por el atacante cuya imagen de Open Graph apunta a un endpoint de imagen interno. Lemmy obtendr\u00e1 esa imagen interna del lado del servidor y almacenar\u00e1 una miniatura local que luego podr\u00e1 ser servida de vuelta a los usuarios. Este problema ha sido parcheado en la versi\u00f3n 0.19.18."}], "id": "CVE-2026-42181", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42181", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T16:00:57.536211Z", "version": "2.0.3"}}]}, "published": "2026-05-08T20:16:31.160", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.19.18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lemmy", "source": "cna", "vendor": "LemmyNet"}, "product": "lemmy", "vendor": "lemmynet"}], "created": "2026-05-08T21:30:05.621193+00:00", "updated": "2026-05-08T22:30:18.071728+00:00", "vendors": ["lemmynet", "lemmynet$PRODUCT$lemmy"]}