Executive brief
LinkAce is a self-hosted tool for archiving and managing website bookmarks. In versions prior to 2.5.6, a security flaw in the initial setup process allows an attacker to take full control of the server. By providing specially crafted database credentials during setup, an attacker can inject malicious commands that the server will execute, leading to a complete compromise of the application and its data.
Technical details
A newline injection vulnerability exists in the DatabaseController::configure() method of LinkAce. During the initial setup of an uninitialized instance, the application fails to escape database credential inputs (specifically db_password) before writing them to the .env file using preg_replace(). An attacker can provide a payload that breaks out of the DB_PASSWORD variable and injects new environment variables, such as MAIL_MAILER=sendmail and MAIL_SENDMAIL_PATH. By then triggering a password reset request, the application uses the injected sendmail path to execute arbitrary shell commands via Symfony's proc_open(). This exploit requires the attacker to have network access to the setup endpoints and a reachable database they control. The issue is resolved in version 2.5.6.
Affected products
- Kovah LinkAce < 2.5.6
Timeline
- 2026-05-10: advisory: GitHub Security Advisory published by vendor
- 2026-05-28: disclosed: CVE published to NVD