CVE-2026-29178
HighSummary
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs.
Risk Assessment
The risk for the organization includes the possibility of using the Lemmy server as a proxy to scan the internal network, access internal resources (e.g., cloud metadata), and conduct attacks on other systems. The vulnerability can be exploited without authentication, increasing its severity.
Recommendation
It is recommended to immediately upgrade Lemmy to version 0.19.16 or later, which includes the fix. If upgrading is not possible, restrict access to the /api/v4/image/{filename} endpoint or apply WAF rules to block suspicious query parameters.
Other vulnerabilities in Lemmy
See all- CVE-2026-54743Medium
Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.
- CVE-2026-54741Medium
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.
- CVE-2026-54740Medium
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.
- CVE-2026-54739Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.
- CVE-2026-54738Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.
- CVE-2026-54742Medium
Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.
Original NVD description (English source)
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.