CVE-2026-29178

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.16

Description Lemmy, a link aggregator and forum for the fediverse, has an issue related to server-side request forgery (SSRF). This is due to a dependency on activitypub federation, a framework for ActivityPub federation in Rust. The GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF because of parameter injection in the file type query parameter. An attacker can inject arbitrary query parameters into an internal request to pict-rs, including the proxy parameter, which causes pict-rs to fetch arbitrary URLs. The file type parameter is directly interpolated into a URL string without validation or encoding. This allows an attacker to construct a malicious URL that instructs pict-rs to fetch content from unintended locations, such as internal services or cloud metadata endpoints. The vulnerable code resides in crates/routes/src/images/download.rs, lines 17-40, within the get image function. The file type parameter (ImageGetParams.file type: Option<String>) is not properly sanitized before being used in the URL construction.

Recommendations Update to Lemmy version 0.19.16 or later.