fider
v0.39.0Open platform to collect and prioritize feedback
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 13 advisories1 critical, 5 high, 7 medium · Scorecard 4.3/10
- Supported versions
- No scheduleendoflife.date does not track this project
4.6k stars · 876 forks · 46 open issues · last release 11 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 13 most recent advisories published by the maintainers: 1 critical, 5 high, 7 medium. Check the patched version against the one you run.
- highGHSA-f9m2-vm33-7hvhNov 4, 2026Blocked administrator's API key remains usable via X-Fider-UserID impersonation
- Affected
- >= 0.17.0, < 0.39.0
- Patched in
- 0.39.0
- mediumGHSA-5x23-xx46-6w7rOct 5, 2026Comments on deleted or declined posts remain readable via the public single-comment API
- Affected
- >= 0.17.0, <= 0.38.1
- Patched in
- 0.38.2
- mediumGHSA-wjrq-7x2x-9p48Oct 5, 2026HTML/markdown injection in notifications via user display name and post title
- Affected
- <= 0.38.1
- Patched in
- 0.38.2
- highGHSA-gw42-7rxg-fmc8Oct 1, 2026Stored XSS via entity-encoded markup in post previews
- Affected
- >= 0.30.0, <= 0.38.0
- Patched in
- 0.38.1
- highGHSA-whx4-hxwq-qgjhSep 28, 2026SSRF via DNS Rebinding in Webhook and Custom OAuth Provider URL Validation
- Affected
- <= 0.37.0
- Patched in
- 0.38.0
- mediumGHSA-7cw3-7xh9-529rSep 28, 2026Denial of Service via image decompression bomb in image upload validation
- Affected
- <= 0.37.0
- Patched in
- 0.38.0
- mediumGHSA-xjr8-w967-4xjqSep 28, 2026Fider CSRF bypass in authenticated no-body API endpoints via Accept header
- Affected
- <= 0.37.0
- Patched in
- 0.38.0
- highGHSA-p8j9-wxg9-qp34Sep 28, 2026Incomplete Fix for GHSA-g445: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4/Teredo)
- Affected
- <= 0.37.0
- Patched in
- 0.38.0
- mediumGHSA-87rv-2gv4-j4v8Sep 24, 2026HTML attribute injection in server-side markdown rendering via unescaped fenced-code info string
- Affected
- >= 0.21.1, < 0.37.0
- Patched in
- 0.37.0
- mediumGHSA-wm2w-gfh7-qg69Jul 3, 2026Unsafe Markdown Rendering Leading to Potential Injection via Unfiltered URL Schemes
- Affected
- < 0.22.0; >= 0.25.0, < 0.37.0
- Patched in
- 0.37.0
- highCVE-2026-65967Jul 3, 2026Server-Side Request Forgery (SSRF) via Webhook URL
- Affected
- < 0.34.0
- Patched in
- 0.34.0
- criticalCVE-2026-65840Jul 3, 2026Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey
- Affected
- < 0.36.0
- Patched in
- 0.36.0
- mediumGHSA-vxp5-mf8m-grg9Apr 28, 2026Authenticated arbitrary blob overwrite via client-controlled attachment bkey allows tenant logo replacement
- Affected
- < 0.34.0
- Patched in
- 0.34.0