EUVD-2026-318138

fkie_cve-2026-42180

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but the audited code path does not reject loopback, private, or link-local destinations before the Webmention request is issued. This lets a normal user trigger server-side HTTP requests toward internal services. This issue has been patched in version 0.19.18.

GHSA-3jvj-v6w2-h948 — Lemmy has SSRF in /api/v3/post via Webmention dispatch

Affected: crates.io: lemmy_api_common

### Summary Lemmy allows an authenticated low-privileged user to create a link post through `POST /api/v3/post`. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target.

The submitted URL is checked for syntax and scheme, but the audited code path does not reject loopback, private, or link-local destinations before the Webmention request is issued. This lets a normal user trigger server-side HTTP requests toward internal services.

### Details The entry point is the normal post creation API. The user-controlled `url` field is accepted, normalized with `diesel_url_create()`, and only validated with `is_valid_url()`. That validation allows `http` and `https` but does not implement internal address rejection.

The post creation flow then schedules Webmention delivery for public communities. This creates a direct source-to-sink path from an externally supplied post URL to a server-side outbound HTTP request.

Core vulnerable code path:

```rust // crates/api_crud/src/post/create.rs let url = diesel_url_create(data.url.as_deref())?; if let Some(url) = &url { is_url_blocked(url, &url_blocklist)?; is_valid_url(url)?; } ```

```rust // crates/utils/src/utils/validation.rs pub fn is_valid_url(url: &Url) -> LemmyResult<()> { let is_valid = ["http", "https", "magnet"].contains(&url.scheme()); if !is_valid { Err(LemmyErrorType::InvalidUrl)? } Ok(()) } ```

```rust // crates/api_crud/src/post/crea…

Most recent entries from all

EUVD-2026-318138

fkie_cve-2026-42180

GHSA-3jvj-v6w2-h948 — Lemmy has SSRF in /api/v3/post via Webmention dispatch