CVE-2026-42181: Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image
(updated )
Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction.
As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users.
References
- github.com/LemmyNet/lemmy/commit/9ffe586dafac1a46acf17edf90e0165e5503b2f1
- github.com/LemmyNet/lemmy/releases/tag/0.19.18
- github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq
- github.com/advisories/GHSA-h6hf-9846-xwrq
- join-lemmy.org/news/2026-04-20_-_Lemmy_Release_v0.19.18
- nvd.nist.gov/vuln/detail/CVE-2026-42181
Code Behaviors & Features
Detect and mitigate CVE-2026-42181 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →