LinkAceのSSRF保護は、LinkAce内部のホスト名解決を介して回避可能

The SSRF vulnerability in LinkAce allows an authenticated user to bypass the intended IP address blocking mechanism. By crafting requests using internal hostnames, an attacker can trigger LinkAce to make requests to internal services that are not directly accessible from the outside. This could lead to the exposure of sensitive data residing on those internal services, such as database credentials, API keys, or internal application data. The blast radius is limited to the internal network accessible by the LinkAce server, but the potential for data exfiltration and lateral movement within that network is significant.

Organizations using LinkAce for link archiving, particularly those with internal services accessible from the LinkAce server, are at risk. Shared hosting environments where LinkAce is installed alongside other applications could also be vulnerable if the LinkAce instance is compromised.

• php / server:

 grep -r "internal_hostname" /path/to/linkace/config.php

• generic web:

curl -I http://your-linkace-instance/internal-resource

Check the response headers for internal IP addresses or hostnames.

1. 2026-03-27Disclosure

   disclosure

1. 予約済み2026-03-24
2. 公開日2026-03-27
3. 更新日2026-03-30
4. EPSS 更新日2026-04-04

The primary mitigation for CVE-2026-33953 is to upgrade LinkAce to version 2.5.3 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to restrict outbound requests based on hostname and protocol. Carefully review LinkAce's configuration to ensure that it is not configured to access overly permissive internal resources. Monitor LinkAce logs for unusual outbound requests that might indicate exploitation attempts. After upgrade, confirm the fix by attempting to trigger an internal request using a hostname and verifying that the request is blocked.