{"id":"CVE-2026-29178","aliases":["GHSA-jvxv-2jjp-jxc3"],"url":"https://o3.security/vulnerability/CVE-2026-29178","summary":"Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint","details":"Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.","published":"2026-03-06T17:56:09.378Z","modified":"2026-08-12T03:51:43.794600219Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"lemmy_routes","fixedVersion":"0.19.16"}],"fix":{"url":"https://github.com/LemmyNet/lemmy/commit/f47a03f56d1797bceab5f34b6f624c91cecd5871","label":"LemmyNet/lemmy@f47a03f"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29178.json"},{"type":"ADVISORY","url":"https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29178"},{"type":"FIX","url":"https://github.com/LemmyNet/lemmy/commit/f47a03f56d1797bceab5f34b6f624c91cecd5871"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:43.794600219Z"}}