Pixelfed’s SearchController, protected by authentication, accepts a remote URL as a search parameter and retrieves the content server‑side using ActivityPubFetchService. The URL validation logic only rejects the literal loopback hosts 127.0.0.1, localhost, and ::1, demands HTTPS, and does not check whether the resolved IP belongs to a private, internal, or link‑local range. Consequently, a logged‑in user can cause the server to issue outbound requests to arbitrary destinations, including internal services such as instance metadata endpoints or other private networks. Because the fetch response body is returned only when the Content‑Type matches an ActivityPub content type, the vulnerability behaves like a semi‑blind SSRF that can still exfiltrate data hidden behind specific content types.

Any Pixelfed deployment built with the pixelfed:pixelfed package that includes the SearchController and ActivityPubFetchService without a patched URL validator is affected. No specific version range is documented in the advisory, so all current releases should be examined for the same code paths.

The CVSS score of 5.7 indicates moderate severity; the EPSS score is not listed, and the vulnerability is not featured in the CISA KEV catalog. Exploitation requires authentication, so the attack surface is limited to any active user of the application. While the SSRF is not fully blind, the restriction to ActivityPub content types limits the ease of data extraction, yet the ability to reach internal systems still poses a notable risk to confidentiality and availability.