LinkAce versions before 2.5.4 contain a Server Side Request Forgery vulnerability that allows an authenticated user to trigger requests from the server to arbitrary IP addresses. By creating a link with a public URL and then updating it to point to a private IP, the internal link‑checking command performs the request server‑side without filtering, revealing responses from internal services such as cloud metadata endpoints or internal APIs. The flaw is a classic input validation weakness (CWE‑918) and can expose sensitive data, credentials, and network topology.

Kovah LinkAce self‑hosted link management application. All releases prior to 2.5.4 are vulnerable; the fix retained in 2.5.4 and later validates the target URL and blocks private IP ranges.

The CVSS score of 5.0 indicates moderate severity. The EPSS score of less than 1% suggests low to moderate likelihood of exploitation, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user; once the attacker can create and update links, they can read internal responses, potentially obtaining credentials or sensitive network information. Patching to 2.5.4 removes the ability to target private addresses, eliminating the risk.