CVE-2026-33953 | BDVDB-2026-323485 Detail

Description#

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side requests to internal services reachable by the LinkAce server but not directly reachable by an external user. Version 2.5.3 patches the issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-27Record published in the CVE List.
2. Version 22026-03-30Most recent update recorded in the CVE List.