FreshRSS vulnerabilities

Products

• FreshRSS 23

Latest FreshRSS CVEs

Newest publication first

1. CVE-2025-68402 FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]

   Published 2026-03-09

   High·CVSS 8.2 EPSS 0.30%

   FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due...

2. CVE-2025-62166 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

   Published 2026-03-09

   High·CVSS 7.5 EPSS 0.43%

   FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should...

3. CVE-2025-68148 FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

   Published 2025-12-26

   High·CVSS 7.5 EPSS 0.46%

   FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has bee...

4. CVE-2025-68932 FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

   Published 2025-12-26

   Low·CVSS 2.9 EPSS 0.55%

   FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid se...

5. CVE-2025-59949 FreshRSS has Logout CSRF that Leads to DoS via <track src>

   Published 2025-12-18

   Medium·CVSS 6.5 EPSS 0.45%

   FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.

6. CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()

   Published 2025-12-15

   High·CVSS 7.4 EPSS 0.70%

   FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include l...

7. CVE-2025-59950 FreshRSS: Double clickjacking can lead to privilege escalation

   Published 2025-09-29

   Medium·CVSS 5.4 EPSS 0.29%

   FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double cli...

8. CVE-2025-61586 FreshRSS is vulnerable to directory enumeration by setting path in its theme field

   Published 2025-09-29

   Medium·CVSS 6.9 EPSS 0.46%

   FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in...

9. CVE-2025-59948 FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page

   Published 2025-09-29

   Medium·CVSS 5.4 EPSS 0.33%

   FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication...

10. CVE-2025-57769 FressRSS: Clickjacking can lead to XSS and/or privilege escalation

    Published 2025-09-29

    Medium·CVSS 5.3 EPSS 0.28%

    FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated...

11. CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled

    Published 2025-09-29

    Critical·CVSS 9.8 EPSS 0.53%

    FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This...

12. CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout

    Published 2025-09-29

    High·CVSS 8.8 EPSS 0.53%

    FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be...

13. CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information

    Published 2025-09-29

    High·CVSS 7.5 EPSS 0.43%

    FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controlle...

14. CVE-2025-54593 FreshRSS is vulnerable to RCE attacks by authenticated admin

    Published 2025-08-01

    High·CVSS 7.2 EPSS 0.94%

    FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successful...

15. CVE-2025-46341 Privilege escalation via SSRF when using HTTP auth

    Published 2025-06-04

    High·CVSS 7.1 EPSS 0.48%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the Remote-User header or the X-WebAuth-User header by making specially crafted requests via the add feed...

16. CVE-2025-46339 FreshRSS vulnerable to favicon cache poisoning via proxy

    Published 2025-06-04

    Medium·CVSS 4.3 EPSS 0.18%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the...

17. CVE-2025-32015 FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>

    Published 2025-06-04

    Medium·CVSS 6.7 EPSS 0.49%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the <iframe srcdoc> attribute, which leads to cross-site scripting (XSS) by loading an attacker's UserJS inside <script src>. In order to execute the attack, the attacker n...

18. CVE-2025-31482 FreshRSS vulnerable to DoS by malicious feed entry loading logout URL

    Published 2025-06-04

    Medium·CVSS 4.3 EPSS 0.18%

    FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.

19. CVE-2025-31136 FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry

    Published 2025-06-04

    Medium·CVSS 5.4 EPSS 0.39%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting (XSS) issue that occurs in f.php when SVG favicons are downloaded from an attacker-controlled feed...

20. CVE-2025-31134 FreshRSS vulnerable to directory enumeration via ext.php

    Published 2025-06-04

    Medium·CVSS 5.5 EPSS 0.47%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is install...

21. CVE-2023-22481 Sensitive information exposure in the logs of greader API in FreshRSS

    Published 2023-03-06

    Medium·CVSS 5.5 EPSS 0.47%

    FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users/_/log_api.txt in the case where the authentication fails. The issues occurs in authorizationToUser() in greader.php. If there is an issue with the request...

22. CVE-2022-23497 Insecure file access in FreshRSS

    Published 2022-12-09

    High·CVSS 7.5 EPSS 0.91%

    FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration...

23. CVE-2018-19782 Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) c parameter or (2) a parameter.

    Published 2019-01-29

    Medium·CVSS 6.1 EPSS 4.4%

    Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) c parameter or (2) a parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.