CVE-2025-62719

LOW EPSS 19.5%
Published Nov 4, 20257mo ago · Modified Jun 17, 20261w ago
2.3 CVSS 4.0
Low
Find Similar
Published Nov 4, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts user-provided URLs and makes HTTP requests to them without validating that the destination is not an internal or private network resource. This Server-Side Request Forgery (SSRF) vulnerability allows authenticated attackers to use the application server to perform port scanning and service discovery on internal networks. Practical impact is very limited because the function only extracts content from HTML meta keywords tags, which prevents meaningful data exfiltration from databases, APIs, or cloud metadata endpoints. This issue is fixed in version 2.4.0.

CVSS Details

Base Score
2.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
19.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
linkacelinkace* <2.4.0

References 3

  • github.com http://github.com/Kovah/LinkAce/releases/tag/v2.4.0
    Release Notes
  • github.com https://github.com/Kovah/LinkAce/commit/4e0b822163ccefc2640c283ae969a39e673a0619
    Patch
  • github.com https://github.com/Kovah/LinkAce/security/advisories/GHSA-473x-rmm6-mc8c
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/Kovah/LinkAce/commit/4e0b822163ccefc2640c283ae969a39e673a0619
    Patch