7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29178

CVE-2026-29178: Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29178

CVE-2026-29178:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lemmy_routes	rust	<= 0.19.15	0.19.16

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the Lemmy server's image fetching functionality. It stems from the file_type query parameter in the /api/v4/image/{filename} endpoint not being properly sanitized before being used to construct a URL for an internal request to the pict-rs image service.

The core of the issue was in the lemmy_routes::images::file_type function, which originally passed the user-provided string without validation. This allowed an attacker to inject arbitrary URL parameters, such as ?proxy=http://internal-service, into the request sent to pict-rs.

The main entry point for this attack is the lemmy_routes::images::get_image function. This function takes the user input and uses helper methods, specifically PictrsGetParams::process_url, to build the final URL. The patch addresses the vulnerability by modifying the PictrsFileType enum to be parsed strictly from a string and adding a default value. The call sites in PictrsGetParams::process_url and ImageProxyParams::process_url were updated to use this new safe parsing, ensuring that any malicious input in the file_type parameter would cause the parsing to fail and fall back to a safe default ('jpg'), effectively neutralizing the SSRF vector.

Vulnerable functions

lemmy_routes::images::get_image

crates/routes/src/images.rs

This is the main unauthenticated API endpoint that receives the tainted `file_type` query parameter. It orchestrates the process of building an internal request to the `pict-rs` service. An attacker targets this function to initiate the SSRF attack.

lemmy_routes::images::PictrsGetParams::process_url

crates/routes/src/images.rs

This function is responsible for constructing the URL for the `pict-rs` image processing service. The vulnerability was caused by this function incorporating the user-supplied `file_type` (via `self.format`) into the URL without proper validation. The patch forces the file type to be one of the values from the `PictrsFileType` enum, defaulting to a safe value (`Jpg`) if parsing fails, thus preventing the injection of arbitrary URL parameters.

lemmy_routes::images::image_proxy

crates/routes/src/images.rs

This is a secondary API endpoint that was also vulnerable to the same SSRF injection vector through the `file_type` (format) parameter. Although harder to exploit due to other validation checks, it contained the same core flaw.

lemmy_routes::images::ImageProxyParams::process_url

crates/routes/src/images.rs

Similar to `PictrsGetParams::process_url`, this function constructed the vulnerable URL for the `image_proxy` endpoint. The patch applies the same fix by ensuring the file type is parsed from a strict enum, mitigating the SSRF vulnerability.

lemmy_routes::images::file_type

crates/routes/src/images.rs

The root cause of the vulnerability lay in the original implementation of this function. It failed to sanitize the `file_type` string, allowing characters like `?` and `&` to be passed through. This enabled parameter injection in the URL construction logic. The fix was to change this function to parse the input string against a strict enum of allowed file types, rejecting any invalid input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.