CVE-2026-42181

{
  "id": "CVE-2026-42181",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T20:16:31.160",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18."
    },
    {
      "lang": "es",
      "value": "Lemmy es un agregador de enlaces y un foro para el fediverso. Antes de la versión 0.19.18, Lemmy obtiene metadatos para las URL de publicaciones proporcionadas por el usuario y, bajo el modo de imagen predeterminado StoreLinkPreviews, descarga la imagen de vista previa a través de pict-rs local. Mientras que la URL de la página de nivel superior se verifica contra rangos de IP internos, la URL og:image extraída no está sujeta a la misma restricción. Como resultado, un usuario autenticado con bajos privilegios puede enviar una página pública controlada por el atacante cuya imagen de Open Graph apunta a un endpoint de imagen interno. Lemmy obtendrá esa imagen interna del lado del servidor y almacenará una miniatura local que luego podrá ser servida de vuelta a los usuarios. Este problema ha sido parcheado en la versión 0.19.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "LemmyNet",
          "product": "lemmy",
          "versions": [
            {
              "version": "< 0.19.18",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T16:00:57.536211Z",
          "id": "CVE-2026-42181",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.18",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}