CVE-2026-44313

CriticalCVSS 9.1

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.

Risk Assessment

An attacker can scan the internal network, access sensitive data, or launch attacks against other internal systems.

Recommendation

Immediately update to version 2.13.0 or later.

Original NVD description (English source)

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior to version 2.13.0, a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function allows authenticated users to make arbitrary HTTP requests to internal services due to insufficient URL validation that only checks for "http://" or "https://" prefixes. This issue has been patched in version 2.13.0.