updated pleroma to latest stable. my instance probably was not vulnerable, since it doesn't have media proxy enabled, but still.