CVE-2026-29178

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/filename endpoint is vulnerable to unauthenticated SSRF...

CVE-2026-29178 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypubfederation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/filename endpoint is vulnerable to unauthenticated SSRF...

lemmy_server (>=0.11.3-rc.5, <=0.16.7) potentially affected by CVE-2026-29178 via lemmy_routes (>=0.11.3-rc.5, <=0.16.7)

lemmyroutes CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: CVE-2026-29178 Source advisory: OSV:GHSA-JVXV-2JJP-JXC3...

CVE-2026-29178

creationtimestamp| type| source ---|---|--- 2026-03-03 20:02:53+00:00| published-proof-of-concept| https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3 2026-03-06 19:15:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfzjl63jy2e...