CVE-2026-29178

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/filename endpoint is vulnerable to unauthenticated SSRF...

CVE-2026-29178 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/filename endpoint is vulnerable to unauthenticated SSRF...

CVE-2026-29178

creationtimestamp| type| source ---|---|--- 2026-03-03 20:02:53+00:00| published-proof-of-concept| https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3 2026-03-06 19:15:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfzjl63jy2e...