CVE-2026-29178
1 advisory.
crates.io/lemmy_routes CVE-2026-29178: high
Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint
Action: Upgrade lemmy_routes to 0.19.16 or later.
cargo update -p lemmy_routes --precise 0.19.16Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.19.16 | - |
Fixed versions
| 0.19.16 |
Sources
- osv: GHSA-jvxv-2jjp-jxc3
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3
- https://nvd.nist.gov/vuln/detail/CVE-2026-29178
- https://github.com/LemmyNet/lemmy/commit/f47a03f56d1797bceab5f34b6f624c91cecd5871
- https://github.com/LemmyNet/lemmy
CVE-2026-29178 · published · modified · JSON