CVE-2026-44313: LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-09 · updated 2026-07-24
Weakness: CWE-918

Description

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior to version 2.13.0, a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function allows authenticated users to make arbitrary HTTP requests to internal services due to insufficient URL validation that only checks for "http://" or "https://" prefixes. This issue has been patched in version 2.13.0.

Affected products

linkwarden: before 2.13.0

References

https://github.com/linkwarden/linkwarden/security/advisories/GHSA-5qpc-x7rv-hvmp
https://github.com/linkwarden/linkwarden/security/advisories/GHSA-5qpc-x7rv-hvmp

Get alerted when CVE-2026-44313 or the next vulnerability affects your stack