CVE-2026-45344
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability in LinkAce before version 2.5.6 allows an attacker to inject malicious mail configuration variables during database setup, leading to remote code execution when emails are sent.
Risk Assessment
An attacker can take over the LinkAce server, gaining access to sensitive data and disrupting service availability.
Recommendation
Immediately update LinkAce to version 2.5.6 or later. Restrict access to setup endpoints to trusted networks only.
Other vulnerabilities in LinkAce
See all- CVE-2026-49436High
LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.
- CVE-2026-45343High
LinkAce before version 2.5.6 contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. An attacker can set their OAuth display name to a malicious script and then create an API token, planting a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context.
- CVE-2026-45342High
LinkAce before version 2.5.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in the authorization policy layer. Any authenticated user can modify resources (links, lists, tags, notes) owned by other users via both the web UI and REST API. The root cause is in the update() methods that incorrectly allow editing resources with public or internal visibility regardless of ownership.
Original NVD description (English source)
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.