CRITICAL SeverityCVSS 3.19.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

CVE-2026-44313

Last updated May 08, 2026 · Published May 08, 2026

Description

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior to version 2.13.0, a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function allows authenticated users to make arbitrary HTTP requests to internal services due to insufficient URL validation that only checks for "http://" or "https://" prefixes. This issue has been patched in version 2.13.0.

Affected products

1 listed

linkwarden:linkwarden

Mappings

CWE

CWE-918

CAPEC

None listed.

Research

Server-Side Request Forgery (SSRF)Explains how untrusted URLs can make servers reach internal or cloud metadata endpoints. Covers validation,…

Guides

Next.js SSRF ProtectionCommon SSRF paths in Next.js and how to block them.

Training

SSRF and Request ForgeryWhen your server makes requests on behalf of an attacker.

CVE-2026-44313

Description

Affected products

Mappings

Related