LinkAce before version 2.5.4 contains an SSRF vulnerability (CWE-918) where authenticated users can manipulate link URLs to cause the server to make requests to internal IP addresses. The lack of validation in LinkRepository::update and CheckLinksCommand::checkLink allows bypassing restrictions on private IPs. The server-side links:check cron job executes these requests without filtering, enabling attackers to access sensitive internal resources such as cloud metadata services. This vulnerability has a CVSS 3.1 score of 5.0 (medium severity) and is patched in version 2.5.4. The product is a cloud service, so remediation is managed by the vendor.

An authenticated user can leverage this SSRF vulnerability to read responses from internal services that are normally inaccessible externally. This includes cloud metadata services (e.g., AWS IMDSv1), internal APIs, and other private network resources. The exposure of such data can lead to disclosure of cloud credentials and internal network topology, which may facilitate further attacks. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

A fix is available in LinkAce version 2.5.4 that properly validates and blocks requests to private IP addresses in the vulnerable functions. Since LinkAce is a cloud service, the vendor manages remediation server-side. Users should ensure they are running version 2.5.4 or later. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.