CVE-2025-62719

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-62719

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62719.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-62719

Aliases

GHSA-473x-rmm6-mc8c

Published

2025-11-04T21:57:15Z

Modified

2025-11-07T04:50:25.923502Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality

Details

LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts user-provided URLs and makes HTTP requests to them without validating that the destination is not an internal or private network resource. This Server-Side Request Forgery (SSRF) vulnerability allows authenticated attackers to use the application server to perform port scanning and service discovery on internal networks. Practical impact is very limited because the function only extracts content from HTML meta keywords tags, which prevents meaningful data exfiltration from databases, APIs, or cloud metadata endpoints. This issue is fixed in version 2.4.0.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/kovah/linkace

Affected ranges

Type

GIT

Repo

http://github.com/kovah/linkace

Events

Introduced

Fixed

88cea68e95cbf5d950c232baae305883fede0cc6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.0"
        }
    ]
}

Affected versions

v0.*

v0.0.1

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.29

v0.0.3

v0.0.30

v0.0.31

v0.0.32

v0.0.33

v0.0.34

v0.0.35

v0.0.36

v0.0.37

v0.0.38

v0.0.39

v0.0.4

v0.0.40

v0.0.41

v0.0.42

v0.0.43

v0.0.44

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.10.0

v1.10.1

v1.10.2

v1.10.3

v1.10.4

v1.10.5

v1.11.0

v1.11.1

v1.11.2

v1.11.3

v1.11.4

v1.12.0

v1.12.1

v1.12.2

v1.13.0

v1.14.0

v1.14.1

v1.14.2

v1.14.3

v1.15.0

v1.15.1

v1.15.2

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v1.3.1

v1.4.0

v1.4.1

v1.5.0

v1.6.0

v1.6.1

v1.6.2

v1.6.3

v1.6.4

v1.7.0

v1.8.0

v1.8.1

v1.9.0

v1.9.1

v1.9.2

v2.*

v2.0.0

v2.0.0-beta1

v2.0.0-beta2

v2.0.0-beta3

v2.0.0-beta4

v2.1.0

v2.1.1

v2.1.2

v2.1.3

v2.1.4

v2.1.5

v2.1.6

v2.1.7

v2.1.8

v2.1.9

v2.2.0

v2.3.0

v2.3.1