CVE-2026-71246

Name of the Vulnerable Software and Affected Versions Pixelfed (affected versions not specified)

Description An authenticated Server-Side Request Forgery (SSRF) exists in the SearchController when processing the remote-search parameter. The ActivityPubFetchService uses a validateUrl() function that only blocks literal hosts such as 127.0.0.1, localhost, and ::1, while requiring HTTPS. It fails to verify if the resolved IP address belongs to private, internal, or link-local ranges, such as 169.254.169.254. Additionally, the optional DNS validation is disabled by default and does not filter by IP range when active. The response body is returned to the user only if the Content-Type matches an ActivityPub content type, resulting in a semi-blind SSRF primitive accessible to any logged-in user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.