The vulnerability arises when Lemmy retrieves Open Graph metadata for user‑supplied URLs. In the StoreLinkPreviews image mode, the Open Graph image is fetched server‑side and stored locally. Because the extracted og:image URL is not validated against internal network ranges, an attacker can cause the system to request an internal resource, expose its content, and serve it to other users. The CVSS score of 6.5 reflects moderate severity, indicating that this flaw can compromise data confidentiality and potentially degrade service availability if abused for large payloads.

All Lemmy installations running a version earlier than 0.19.18 are impacted. The affected product is Lemmy, a federated link aggregator, from the vendor LemmyNet. The flaw exists in the mechanism that fetches link preview images on post creation or link share.

The risk level is medium. An authenticated user with low privileges can submit a malicious link; the server then performs a request to an internal endpoint, stores the resulting image, and later serves it to other users. The exploit does not require additional privileges beyond standard account rights. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, so while exploitation is possible, it is not yet verified as actively exploited in the wild.