CVE-2026-29178 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
Unauthenticated attackers can exploit SSRF in Lemmy's image endpoint to force the server to fetch arbitrary internal or external URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29178?
CVE-2026-29178 is a high-severity server-side request forgery vulnerability in LemmyNet lemmy, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.
Weakness: CWE-918
Which versions are affected by CVE-2026-29178?
2 open source packages ship an affected version, including lemmy_routes.
| Package | Affected | Fixed in |
|---|---|---|
lemmy_routes crates.io | All versions | 0.19.16 |
lemmy_routes crates.io | All versions | 0.19.16 |
How do I fix CVE-2026-29178?
Upgrade lemmy_routes to 0.19.16 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-29178 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29178 exists.
Sources
Also known as GHSA-jvxv-2jjp-jxc3.