2 matches found
CVE-2026-71246
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
4.3CVSS0.0027EPSS
SaveExploits0References1
CVE-2026-71246: Server-Side Request Forgery (SSRF)
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
4.3CVSS5.8AI score0.0027EPSS
SaveExploits0References2
20