CVE-2026-33953: Linkace

High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days.

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side requests to internal services reachable by the LinkAce server but not directly reachable by an external user. Version 2.5.3 patches the issue.

Affected products

• Linkace Linkace: before 2.5.3 (fixed in 2.5.3)

Published 2026-03-27. Last modified 2026-06-17.