2026-11-03 11:22 UTC
@dansup@mastodon.social Tried adding the .env variable but it didn't seem to have any effect.
I tried looking through the code, I think this was the commit that blocked the private IPs:
https://github.com/pixelfed/pixelfed/commit/0e0de62dd9767f8da8a76fa0ff4e5e2be5981744
Am assuming it's related to the SSRF mentioned in CVE-2026-71246.
It looks like there is a boolean env variable for "AP_SKIP_LOCAL_URL_CHECKS". Not sure if that will do something.
Replies (2)
-
@dansup@mastodon.social 2026-11-03 11:27
@coltofox@red.fox.yt Ah right, I will ship a fix for this!
-
@dansup@mastodon.social 2026-11-03 12:01
@coltofox@red.fox.yt Fixed! https://github.com/pixelfed/pixelfed/pull/7921