CVE-2026-29178: Lemmy Link Aggregator SSRF Vulnerability

CVE-2026-29178 Overview

Lemmy, a link aggregator and forum for the fediverse, contains a Server-Side Request Forgery (SSRF) vulnerability in its image handling endpoint. The vulnerability exists due to improper input validation in the GET /api/v4/image/{filename} endpoint, which allows unauthenticated attackers to inject arbitrary query parameters through the file_type query parameter. This parameter injection can be leveraged to manipulate internal requests to the pict-rs image processing service, enabling attackers to force the server to fetch arbitrary external URLs.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to probe internal network resources, access cloud metadata services, or pivot to attack internal systems that would otherwise be unreachable from the internet.

Affected Products

• Lemmy versions prior to 0.19.16
• Instances using activitypub_federation framework for ActivityPub federation
• Deployments utilizing pict-rs for image processing

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-29178 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29178

Vulnerability Analysis

This SSRF vulnerability stems from insufficient input sanitization in Lemmy's image API endpoint. The GET /api/v4/image/{filename} endpoint accepts a file_type query parameter that is not properly validated before being incorporated into internal requests to the pict-rs image processing backend. An attacker can exploit this by injecting additional query parameters, specifically the proxy parameter, which instructs pict-rs to fetch content from arbitrary URLs.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources based on user-supplied input without proper validation of the destination URL. In this case, the parameter injection technique bypasses any existing URL validation because the malicious parameter is injected through an unexpected vector.

Root Cause

The root cause is improper input validation and lack of parameter sanitization in the file_type query parameter handler. The application fails to properly encode or validate the file_type parameter before constructing internal HTTP requests to the pict-rs service. This allows attackers to inject additional query string parameters that modify the behavior of the downstream request.

Attack Vector

This vulnerability is exploitable over the network without authentication. An attacker can craft malicious HTTP requests to the vulnerable endpoint, injecting the proxy parameter through the file_type query string. When pict-rs receives this manipulated request containing the proxy parameter, it will fetch the specified URL, effectively allowing the attacker to:

• Probe internal network services and infrastructure
• Access cloud provider metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254)
• Scan internal ports and services
• Potentially exfiltrate sensitive data from internal resources
• Bypass network security controls and firewalls

The attack requires no user interaction and can be executed by sending a single crafted HTTP request to the vulnerable endpoint. The proxy parameter causes pict-rs to act as an open proxy, fetching arbitrary URLs on behalf of the attacker.

Detection Methods for CVE-2026-29178

Indicators of Compromise

• Unusual requests to /api/v4/image/ endpoints containing encoded characters or multiple query parameters in the file_type value
• Server-side requests originating from the Lemmy/pict-rs service to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) from the application server
• Anomalous outbound connections from the pict-rs process to unexpected destinations

Detection Strategies

• Implement web application firewall (WAF) rules to detect parameter injection patterns in query strings
• Monitor application logs for requests containing suspicious characters (&, =, %) in the file_type parameter
• Deploy network monitoring to detect outbound connections from the Lemmy/pict-rs service to internal networks or cloud metadata services
• Analyze HTTP access logs for repeated requests to the image endpoint with varying file_type values

Monitoring Recommendations

• Enable verbose logging on the pict-rs image processing service to track all proxy requests
• Implement egress filtering and monitoring on the server hosting Lemmy to detect unauthorized outbound connections
• Set up alerts for any connections to RFC 1918 private IP addresses or link-local addresses from the application tier
• Review web server access logs regularly for patterns indicative of SSRF exploitation attempts

How to Mitigate CVE-2026-29178

Immediate Actions Required

• Upgrade Lemmy to version 0.19.16 or later immediately
• Implement network-level restrictions to prevent the application server from making requests to internal networks
• Configure firewall rules to block outbound connections from pict-rs to sensitive internal resources
• Consider implementing a WAF rule to block requests with suspicious file_type parameter values

Patch Information

The vulnerability has been addressed in Lemmy version 0.19.16. The fix is available in the GitHub commit f47a03f56d1797bceab5f34b6f624c91cecd5871. Organizations should review the GitHub Security Advisory GHSA-jvxv-2jjp-jxc3 for complete details on the vulnerability and remediation steps.

Workarounds

• Implement strict input validation on the file_type parameter at the reverse proxy or WAF level to reject requests containing unexpected characters
• Deploy network segmentation to isolate the Lemmy application from sensitive internal resources
• Configure egress filtering to allow pict-rs to only connect to approved external domains
• If possible, disable or restrict access to the /api/v4/image/ endpoint until patching is complete

# Example nginx configuration to restrict suspicious file_type parameters
location /api/v4/image/ {
    # Block requests with potentially malicious file_type values
    if ($arg_file_type ~* "[&=%]") {
        return 403;
    }
    
    # Proceed with normal proxy pass
    proxy_pass http://lemmy_backend;
}