Skip to content
OpenAdvisories

Vendor

pixelfed

6 known vulnerabilities.

Products

pixelfed 4 pixelfed/pixelfed 2
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-86178

    Pixelfed through 0.12.9 Unauthorized Story Access via API

    Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to ret…

    pixelfed pixelfed
  • Medium 4.3
    CVE-2026-71246

    Pixelfed - Authenticated SSRF via Remote URL Search

    Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires http…

    pixelfed pixelfed
  • Medium 4.3
    CVE-2025-30741

    Pixelfed may allow unauthorized actor to view private posts and private users

    Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.

    pixelfed pixelfed pixelfed/pixelfed Packagist
  • Medium 4.3
    CVE-2023-0914

    Improper Authorization in pixelfed/pixelfed

    Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.

    pixelfed pixelfed/pixelfed pixelfed/pixelfed Packagist
  • Medium 5.3
    CVE-2023-0901

    Exposure of Sensitive Information to an Unauthorized Actor in pixelfed/pixelfed

    Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.

    pixelfed pixelfed/pixelfed pixelfed/pixelfed Packagist