Is CVE-2026-52101 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52101 being exploited in the wild.

How severe is CVE-2026-52101?

Informational severity, published 14 July 2026.

Which products and versions are affected?

Andrei Marcu Linx-Server 1.0 through 2.3.8.

Is there a fix for CVE-2026-52101?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52101 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-52101?

Check whether you run Andrei Marcu Linx-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52101: andreimarcu linx-server SSRF in uploadRemote function

CVE-2026-52101 · Severity: info · Published 2026-07-14

linx-server is a self-hosted platform for sharing files, code, and media. A security flaw in its remote upload feature allows an attacker to force the server to make requests to internal or external web addresses. This could lead to the exposure of sensitive internal information or allow the attacker to interact with other private services running on the same network as the server.

Technologies: Andrei Marcu Linx-Server. Vendors: Andrei Marcu.

Quick answers

Is CVE-2026-52101 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52101 being exploited in the wild.
How severe is CVE-2026-52101?: Informational severity, published 14 July 2026.
Which products and versions are affected?: Andrei Marcu Linx-Server 1.0 through 2.3.8.
Is there a fix for CVE-2026-52101?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52101 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-52101?: Check whether you run Andrei Marcu Linx-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in linx-server versions 1.0 through 2.3.8. The vulnerability is located in the uploadRemote function within upload.go, which handles the remote upload feature. The application fails to properly validate or sanitize user-supplied URLs before the server attempts to fetch them. A remote attacker can exploit this to make the server perform unauthorized requests to internal network resources or external services, potentially leading to information disclosure or further internal network scanning. This occurs when the -remoteuploads configuration is enabled.

Affected products

andreimarcu linx-server 1.0 through 2.3.8

Timeline

2026-07-14: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.