EUVD-2026-53319
GHSA-5cfc-gvxj-5r55
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible authenticated endpoint (AV:N, PR:L); semi-blind ActivityPub Content-Type filter limits exfiltration to low confidentiality impact; no integrity or availability effect.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
1DescriptionCVE.org
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl() only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254). Optional DNS validation is disabled by default and, when enabled, only confirms a DNS record exists without filtering by IP range. The fetch response body is returned to the requester only when the Content-Type matches an ActivityPub content type, making this a semi-blind but authenticated SSRF primitive reachable by any logged-in user.
AnalysisAI
Authenticated SSRF in Pixelfed's SearchController allows any logged-in user to trigger server-side HTTP fetches to internal network resources, including cloud metadata endpoints such as 169.254.169.254. The root bypass is in ActivityPubFetchService's validateUrl(), which blocks only literal loopback hostnames without resolving DNS names to validate the resulting IP against private or link-local ranges - a classic pre-resolution validation gap. No active exploitation (CISA KEV) or public POC has been identified, but the low attack complexity, broad eligibility (any authenticated user), and high-value targets in cloud-hosted deployments make this a realistic internal reconnaissance and credential-theft risk.
Technical ContextAI
Pixelfed is a federated image-sharing platform implementing the ActivityPub protocol (W3C standard for decentralized social networking). The vulnerable component is SearchController, placed behind Pixelfed's authentication middleware, which exposes remote-search parameters that accept attacker-supplied URLs. These are forwarded to ActivityPubFetchService for server-side retrieval. The service's validateUrl() performs only string-level checks against the literal values 127.0.0.1, localhost, and ::1, and enforces HTTPS on the scheme - but never resolves the supplied hostname to an IP address before fetching. This means any internal hostname or DNS name resolving to a private RFC 1918 range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local range (169.254.0.0/16), or other non-public IP bypasses the blocklist entirely. An optional DNS validation feature exists but is disabled by default; when enabled, it only confirms that a DNS record exists, not that the resolved IP is in a permitted range. CWE-918 (Server-Side Request Forgery) is the root cause class: the application acts as an unintentional proxy on behalf of the attacker. The response-filtering behavior - only surfacing content to the requester when the Content-Type matches an ActivityPub media type such as application/activity+json - makes this a semi-blind SSRF: useful for probing ActivityPub-speaking internal services directly, and for blind probing of others.
RemediationAI
No vendor-released patch version has been confirmed from the available data - the single reference points to https://github.com/pixelfed/pixelfed without specifying a fix commit or tagged release. Operators should actively monitor the repository for commits addressing the validateUrl() IP-range bypass and apply any patch immediately upon release. As an immediate compensating control, apply outbound firewall rules on the Pixelfed application server to block access to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and other non-routable ranges - note that this may interfere with federation if any legitimate ActivityPub peers are hosted on private networks. On AWS deployments, enforce IMDSv2 (requiring a session token for metadata access) to prevent SSRF-driven credential theft from the instance metadata service even if the network-level control is not applied. Enabling Pixelfed's optional DNS validation feature provides marginal incremental defense but does not close the vulnerability because it does not filter by resolved IP range; it should not be relied upon as the primary mitigation. Restricting user registration to trusted accounts reduces the attacker pool but does not eliminate risk from compromised or malicious authenticated users.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today