Friendica vulnerabilities
Published CVEs affecting Friendica products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-72597
Medium · 6.5
CWE-918 Aug 11, 2026
Friendica Friendica - Server-Side Request Forgery
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can use this to scan the internal network or access cloud metadata services.
CVE-2026-72550
Critical · 9.8
CWE-89 Aug 11, 2026
Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.