Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-29178

26
FAUCET Score

CVE-2026-29178 describes an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Lemmy, a fediverse link aggregator, affecting versions prior to 0.19.16. This flaw, rooted in the activitypub_federation dependency, allows attackers to inject parameters into the GET /api/v4/image/{filename} endpoint, forcing the pict-rs service to fetch arbitrary URLs. With a CVSS score of 7.7 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to significant information disclosure. Currently, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
LemmyNetLemmy
< 0.19.16CNA affected

CVSS Data

CVSS version used by this source: 4.0

7.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
PROOF_OF_CONCEPT
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.27%
Probability of exploitation in next 30 days
EPSS Percentile
19.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0027 is in the 4th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

rustpatch availablevia ghsa
Product: lemmy_routesFixed in: 0.19.16

Vendor Advisories (1)

rustGHSA-jvxv-2jjp-jxc3high

Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

Mar 4, 2026

References

github.com / LemmyNet/lemmy/commit/f47a03f56d1797bceab5f34b6f624c91cecd5871
github.com / LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3