FKIE_CVE-2026-45344

Vulnerability from fkie_nvd - Published: 2026-05-28 22:17 - Updated: 2026-07-21 10:10
Severity
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.
References
security-advisories@github.comhttps://github.com/Kovah/LinkAce/security/advisories/GHSA-37m5-936h-w455
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/Kovah/LinkAce/security/advisories/GHSA-37m5-936h-w455
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "LinkAce",
          "vendor": "Kovah",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6."
    },
    {
      "lang": "es",
      "value": "LinkAce es un archivo autoalojado para recopilar enlaces de sitios web. Antes de la 2.5.6, el flujo de configuraci\u00f3n de la base de datos de la instalaci\u00f3n en instancias de LinkAce no inicializadas acepta campos de credenciales de la base de datos controlados por el atacante y los escribe de nuevo en .env sin escapar. Un atacante remoto que puede alcanzar los puntos finales de configuraci\u00f3n y proporcionar una base de datos que controla puede inyectar variables de configuraci\u00f3n de correo y lograr la ejecuci\u00f3n de comandos cuando la aplicaci\u00f3n env\u00eda correo m\u00e1s tarde. Esta vulnerabilidad se corrige en la 2.5.6."
    }
  ],
  "id": "CVE-2026-45344",
  "lastModified": "2026-07-21T10:10:00.103",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45344",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-01T18:50:26.732286Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-28T22:17:00.497",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Kovah/LinkAce/security/advisories/GHSA-37m5-936h-w455"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Kovah/LinkAce/security/advisories/GHSA-37m5-936h-w455"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.