CVE-2026-29178Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-06); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-06	2	Disclosure2
2026-03-25	1	General1
2026-04-24	1	Disclosure1

Full discourse4 posts

秋风@q1uf3ng197d
General
What are the limits of AI-assisted vulnerability hunting? I obtained 23 CVEs in one month. BentoML 8.2k CVE-2026-27905 HIGH SillyTavern 24.6k CVE-2026-26286 HIGH Plane 28.2k CVE-2026-27705 MEDIUM NocoDB 46.4k CVE-2026-28399 MEDIUM Mautic 8.4k CVE-2026-3105 HIGH File Browser 27.9k CVE-2026-28492 HIGH OpenReplay 7.3k CVE-2026-28443 MEDIUM SuiteCRM 4.0k CVE-2026-29096 HIGH Pimcore 3.6k CVE-2026-27461 HIGH Craft CMS 5.2k CVE-2026-32263 MEDIUM Froxlor 1.6k CVE-2026-30932 HIGH Actual Budget 3.2k CVE-2026-27638 HIGH Lemmy 14.0k CVE-2026-29178 MEDIUM Chartbrew 2.6k CVE-2026-27005 HIGH Tautulli 1.7k CVE-2026-28505 HIGH Typebot 9.5k CVE-2026-33712 CRITICAL LibreChat 34.7k CVE-2026-31942 HIGH Coolify 33.8k CVE-2026-27883 HIGH Gotenberg 3.0k CVE-2026-27018 HIGH Unkey 5.2k CVE-2026-28339 MEDIUM Piwigo 3.3k CVE-2026-27634 CRITICAL Pixelfed 10.7k CVE-2026-27011 HIGH Follow (Folo) 3.0k CVE-2026-27499 HIGH
Post summary
The user reports discovering 23 new CVEs with severity ratings but provides no further technical, exploit, or mitigation details.
720220514825.9K
1.7K followersView on X
DailyCVE@dailycve167d
Disclosure
🟠 Lemmy, SSRF via Open Graph Image Metadata, #CVE-2026-29178 (Medium) https://dailycve.com/lemmy-ssrf-via-open-graph-image-metadata-cve-2026-29178-medium/
Post summary
The tweet announces a new medium‑severity SSRF vulnerability (CVE‑2026‑29178) in Lemmy, but it does not provide exploitation details, a PoC, or mitigation guidance.
0000084
183 followersView on X
CVE@CVEnew215d
Disclosure
CVE-2026-29178 Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for Activit… https://www.cve.org/CVERecord?id=CVE-2026-29178
Post summary
CVE‑2026‑29178 identifies a server‑side request forgery issue in Lemmy’s dependency activitypub_federation.
0000091
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash215d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-29178 - Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint Intel Report: https://ift.tt/ot6D9b2
Post summary
The alert announces CVE-2026-29178 in Lemmy, describing it as an unauthenticated SSRF through a file_type injection in the image endpoint, with no information on patches, exploitation, or PoC.
0000020
343 followersView on X

Explore more

Back to dashboard