Server-Side Request Forgery Vulnerability in Pixelfed's SearchController
CVE-2026-71246

5.7MEDIUM

Key Information:

Vendor

Pixelfed

Status
Pixelfed
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71246?

The SearchController in Pixelfed allows authenticated users to submit a URL through remote-search parameters, which it subsequently fetches server-side via ActivityPubFetchService. The current validation in validateUrl() only blocks a few specific hosts (127.0.0.1, localhost, and ::1) and mandates HTTPS without adequate checks against private, internal, or link-local IP ranges. While optional DNS validation is available, it is disabled by default, and even when enabled, it merely confirms the existence of a DNS record without appropriate filtering on IP addresses. This flaw exposes the system to semi-blind SSRF attacks that logged-in users could potentially exploit, leading to security risks pertaining to sensitive data accessed via crafted requests.

Affected Version(s)

pixelfed 0

References

https://github.com/pixelfed/pixelfed

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.