A new Pleroma security release is out that you should install immediately. If you can not do so for some reason, activate filename anonymization.

Thanks to @feld and @lanodan for handling this so quickly!

https://pleroma.social/announcements/2023/08/04/pleroma-security-release-2.5.3/