Pleroma is full of security vulnerabilities because OnlyFans paid people on Upwork to implement a bunch of features nobody wants.

Have you ever tried downloading an emoji pack from a server? No? Well that's the vulnerable code.

Anyway, hopefully everyone is using s3 for uploads by now and has the dedupe filter enabled.

Patch is being merged into Rebased now: https://gitlab.com/soapbox-pub/rebased/-/merge_requests/263

A patch was ready yesterday but I figured I'd wait til after it landed upstream first.

RT: https://pleroma.soykaf.com/objects/c655af15-7632-41e6-86f3-d06ab5bbb84a