Lemmyにおいて、画像エンドポイントのfile_typeクエリパラメータへのパラメータインジェクションにより認証されていないSSRFの脆弱性があります

The SSRF vulnerability in Lemmy allows attackers to bypass security controls and make requests to internal or external resources as if they were originating from the Lemmy server. By injecting the proxy parameter into the file_type query parameter of the /api/v4/image/{filename} endpoint, an attacker can force Lemmy to fetch arbitrary URLs. This could lead to the exposure of sensitive internal data, such as configuration files or database credentials, or even allow an attacker to interact with other internal services. The blast radius extends to any internal resources accessible from the Lemmy server, potentially compromising the entire infrastructure.

Lemmy instances running versions prior to 0.19.16 are at risk. This includes self-hosted instances, as well as those hosted on shared infrastructure where the server environment might be less controlled. Instances that expose internal services accessible via HTTP are particularly vulnerable.

• linux / server:

journalctl -u lemmy -f | grep "proxy="

• generic web:

curl -I http://your-lemmy-instance/api/v4/image/test.jpg?file_type=image/png&proxy=http://example.com

1. 2026-03-04Disclosure

   disclosure

1. 予約済み2026-03-04
2. 公開日2026-03-04
3. 更新日2026-03-06
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-29178 is to upgrade Lemmy to version 0.19.16 or later, which includes a fix for the vulnerability. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious file_type parameters with the proxy parameter. Additionally, review and restrict network access for the Lemmy server to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to access an external URL via the vulnerable endpoint and verifying that the request is blocked or handled securely.