LinkAce, a self-hosted link archive, has a Server‑Side Request Forgery flaw because certain code paths avoid checking for private IP addresses. The vulnerability allows an authenticated user to craft or update a link URL so that a background cron job fetches data from an internal service or cloud metadata endpoint. As a result, sensitive internal information—such as cloud credentials, internal APIs, and network topology—can be exposed. The weakness is classified as CWE‑918.

The flaw affects all installations of Kovah's LinkAce application up to, but not including, version 2.5.4. Versions prior to 2.5.4 lack the IP‑address validation in both the LinkRepository::update method and the CheckLinksCommand::checkLink scheduler task.

The CVSS score of 5.0 reflects moderate severity. Exploitation requires legitimate authentication to the application and the ability to create or update a link, and it is performed server‑side by a cron job. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Nonetheless, the potential to expose cloud metadata or internal services warrants prompt attention.