Executive brief
linx-server is a self-hosted platform for sharing files, code, and media. A security flaw in its remote upload feature allows an attacker to force the server to make requests to internal or external web addresses. This could lead to the exposure of sensitive internal information or allow the attacker to interact with other private services running on the same network as the server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in linx-server versions 1.0 through 2.3.8. The vulnerability is located in the uploadRemote function within upload.go, which handles the remote upload feature. The application fails to properly validate or sanitize user-supplied URLs before the server attempts to fetch them. A remote attacker can exploit this to make the server perform unauthorized requests to internal network resources or external services, potentially leading to information disclosure or further internal network scanning. This occurs when the -remoteuploads configuration is enabled.
Affected products
- andreimarcu linx-server 1.0 through 2.3.8
Timeline
- 2026-07-14: advisory: NVD publication date