Pleroma is full of security vulnerabilities because OnlyFans paid people on Upwork to implement a bunch of features nobody wants.

Have you ever tried downloading an emoji pack from a server? No? Well that's the vulnerable code.

Anyway, hopefully everyone is using s3 for uploads by now and has the dedupe filter enabled.