CVE-2026-35516: Linkace

Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days.

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.

Affected products

• Linkace Linkace: before 2.5.4 (fixed in 2.5.4)

Published 2026-04-07. Last modified 2026-06-17.