VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 8, 2026· Updated May 12, 2026

CVE-2026-42181

CVE-2026-42181

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
lemmy_api_commoncrates.io
< 0.19.180.19.18

Affected products

1

Patches

1
9ffe586dafac

Add more checks for internal IPs (#6454)

https://github.com/LemmyNet/lemmyNutomicApr 17, 2026via ghsa
commit
2 files changed · +5 −1
  • crates/api_common/src/request.rs+3 −0 modified
    @@ -404,6 +404,7 @@ struct PictrsPurgeResponse {
 /// - It might not be an image
 /// - Pictrs might not be set up
 pub async fn purge_image_from_pictrs(image_url: &Url, context: &LemmyContext) -> LemmyResult<()> {
+  validate_link_ip(image_url).await?;
   is_image_content_type(context.client(), image_url).await?;
 
   let alias = image_url
@@ -457,6 +458,7 @@ pub async fn delete_image_from_pictrs(
 /// Retrieves the image with local pict-rs and generates a thumbnail. Returns the thumbnail url.
 #[tracing::instrument(skip_all)]
 async fn generate_pictrs_thumbnail(image_url: &Url, context: &LemmyContext) -> LemmyResult<Url> {
+  validate_link_ip(image_url).await?;
   let pictrs_config = context.settings().pictrs_config()?;
 
   match pictrs_config.image_mode() {
@@ -516,6 +518,7 @@ pub async fn fetch_pictrs_proxied_image_details(
   image_url: &Url,
   context: &LemmyContext,
 ) -> LemmyResult<PictrsFileDetails> {
+  validate_link_ip(image_url).await?;
   let pictrs_url = context.settings().pictrs_config()?.url;
   let encoded_image_url = encode(image_url.as_str());
  • crates/api_common/src/utils.rs+2 −1 modified
    @@ -1,6 +1,6 @@
 use crate::{
   context::LemmyContext,
-  request::{delete_image_from_pictrs, fetch_pictrs_proxied_image_details},
+  request::{delete_image_from_pictrs, fetch_pictrs_proxied_image_details, validate_link_ip},
   site::{FederatedInstances, InstanceWithFederationState},
 };
 use chrono::{DateTime, Days, Local, TimeZone, Utc};
@@ -913,6 +913,7 @@ async fn proxy_image_link_internal(
   image_mode: PictrsImageMode,
   context: &LemmyContext,
 ) -> LemmyResult<DbUrl> {
+  validate_link_ip(&link).await?;
   // Dont rewrite links pointing to local domain.
   if link.domain() == Some(&context.settings().hostname) {
     Ok(link.into())

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.