Pixelfed's SearchController, which requires authentication, receives a URL parameter for remote search and fetches that URL via ActivityPubFetchService. The validator for the URL only blocks the literal hosts 127.0.0.1, localhost, and ::1 and enforces an HTTPS scheme, but it does not check whether the resolved IP address lies within private, internal, or link‑local ranges such as 169.254.169.254. Consequently, an authenticated user can cause the server to issue outbound requests to arbitrary hosts, including internal services or instance metadata endpoints. This flaw is a form of authenticated server‑side request forgery (CWE‑918).

Any Pixelfed deployment built with the pixelfed:pixelfed package that includes the SearchController and ActivityPubFetchService without a patched URL validator is affected. No specific version range is documented in the advisory, so all current releases should be examined for the same code paths.

The CVSS score is 4.3, indicating moderate severity. The EPSS score is less than 1 %, reflecting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to exploit the flaw, which limits the surface to active users. Once authenticated, the attacker can direct the server to access internal or remote systems, potentially discovering internal resources or extracting sensitive data discovered over HTTP/HTTPS. Overall, the risk is moderate but warrants timely remediation.