CVE-2026-35516
Medium
Description
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.
SeverityMedium
CVSS5.0
Exploit probability—
ProductLinkace
PublishedApr 7, 2026
First seenApr 7, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- linkace linkace2.5.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linkace linkace | v < 2.5.4 | 2.5.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.