EUVD-2026-274850

fkie_cve-2026-29178

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.

GHSA-jvxv-2jjp-jxc3 — Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

Affected: crates.io: lemmy_routes

## Summary

The `GET /api/v4/image/{filename}` endpoint is vulnerable to unauthenticated SSRF through parameter injection in the `file_type` query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the `proxy` parameter which causes pict-rs to fetch arbitrary URLs.

## Affected code

`crates/routes/src/images/download.rs`, lines 17-40 (`get_image` function):

```rust pub async fn get_image( filename: Path<String>, Query(params): Query<ImageGetParams>, req: HttpRequest, context: Data<LemmyContext>, ) -> LemmyResult<HttpResponse> { let name = &filename.into_inner(); let pictrs_url = context.settings().pictrs()?.url; let processed_url = if params.file_type.is_none() && params.max_size.is_none() { format!("{}image/original/{}", pictrs_url, name) } else { let file_type = file_type(params.file_type, name); let mut url = format!("{}image/process.{}?src={}", pictrs_url, file_type, name); // ... }; do_get_image(processed_url, req, &context).await } ```

The `file_type` parameter (`ImageGetParams.file_type: Option<String>`) is directly interpolated into the URL string without any validation or encoding. Since pict-rs's `/image/process.{ext}` endpoint supports a `?proxy={url}` parameter for fetching remote images, an attacker can inject `?proxy=...` via `file_type` to make pict-rs fetch arbitrary URLs.

This endpoint does not require authentication (no `LocalUserView` extractor).

## PoC

```b…

Most recent entries from all

EUVD-2026-274850

fkie_cve-2026-29178

GHSA-jvxv-2jjp-jxc3 — Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint