CVE-2025-30741
CVE-2025-30741
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.
CVSS 4.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
pixelfed
- Versions
- ≥ 0, < 0.12.5: Affected (semver)
Update to 0.12.5
pixelfed/pixelfed Packagist
- Versions
- v0.1.9
- v0.10.0
- v0.10.1
- v0.10.10
- v0.10.2
- v0.10.3
- v0.10.4
- v0.10.5
- v0.10.6
- v0.10.7
- v0.10.8
- v0.10.9
- v0.11.0
- v0.11.1
- v0.11.10
- v0.11.11
- v0.11.12
- v0.11.13
- v0.11.2
- v0.11.3
- v0.11.4
- v0.11.5
- v0.11.6
- v0.11.7
- v0.11.8
- v0.11.9
- v0.12.0
- v0.12.1
- v0.12.2
- v0.12.3
- v0.12.4
- v0.5.9
- v0.6.0
- v0.6.1
- v0.7.6
- v0.8.0
- v0.8.5
- v0.8.6
- v0.9.0
- v0.9.4
- v0.9.5
- v0.9.6
- Affected ranges
- ECOSYSTEM: < 0.12.5
Update to 0.12.5