Linkwarden’s fetchTitleAndHeaders function validates URLs only by checking for a "http://" or "https://" prefix. Because the remaining part of the URL is not inspected, an authenticated user can supply any URL, including internal or localhost addresses. The server then performs an outbound HTTP request to that address, allowing the attacker to reach internal services and potentially expose sensitive data or interact with internal endpoints. This flaw qualifies as a Server‑Side Request Forgery (SSRF).

The vulnerability is present in all releases of the self‑hosted Linkwarden bookmark manager prior to version 2.13.0. The issue was fixed in the 2.13.0 release; no other affected versions are documented.

The CVSS score of 9.1 classifies the vulnerability as Critical. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the application so that they can submit a malicious URL to the vulnerable endpoint. Once authenticated, the attacker can direct the server to any address reachable from the hosting environment, making the attack straightforward in configurations where the application can reach internal services.