Pixelfed

6 CVEs across 2 Pixelfed products. Browse Pixelfed vulnerabilities, severities, and proof-of-concept exploits.

Pixelfed products with known CVEs

ProductCVEs
Pixelfed6
Pixelfed/pixelfed2
Pixelfed CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-86178Medium5.42026-09-05Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access followe…
CVE-2026-71246Medium4.32026-08-05Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchServ…
CVE-2025-30741Medium4.32025-03-25Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse…
CVE-2024-25108Critical9.92024-02-12Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce…
CVE-2023-0914Medium5.32023-02-19Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
CVE-2023-0901Medium5.32023-02-18Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.