Lemmy, a fediverse link aggregator and forum software, prior to version 0.19.18, performs metadata fetching for user-submitted URLs including downloading preview images through a local image service (pict-rs). The top-level URL is checked against internal IP ranges to prevent SSRF, but the Open Graph image URL (og:image) extracted from the page is not subjected to the same validation. This allows an authenticated user with low privileges to submit a public page whose og:image points to an internal network resource. Lemmy then fetches this internal image server-side, stores a local thumbnail, and serves it back to users. This SSRF vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 6.5 (medium severity). The issue is fixed in Lemmy version 0.19.18.

An authenticated low-privileged user can exploit this vulnerability to make the Lemmy server perform unauthorized requests to internal network resources by controlling the og:image URL of a submitted post. This can lead to unauthorized access to internal services or information disclosure within the internal network. The vulnerability does not impact confidentiality of the Lemmy server itself directly but can expose internal endpoints to the attacker indirectly. There is no indication of impact on integrity or availability.

This vulnerability has been patched in Lemmy version 0.19.18. Users and administrators should upgrade to version 0.19.18 or later to remediate this issue. Since the vendor advisory or patch links are not explicitly provided, confirm the upgrade from official Lemmy release notes or repositories. No additional mitigation steps are indicated or required beyond applying the official patch.