PT-2025-23846 · Freshrss · Freshrss

Inverle · Published 2025-06-04 · Updated 2025-06-05 · CVE-2025-31134

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.26.2

Description FreshRSS is a self-hosted RSS feed aggregator. An attacker can gain additional information about the server by checking if certain directories exist, potentially discovering older PHP versions or installed software. This information could be used to further attack the server.

Recommendations For versions prior to 1.26.2, update to version 1.26.2 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-31134

GHSA-JJM2-4HF7-9X65

Affected Products

Freshrss

References · 7

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31134.json · Exploit
• https://github.com/FreshRSS/FreshRSS/commit/4568111c00813756a3a34a381d684b8354fc4438 · Patch
• https://osv.dev/vulnerability/CVE-2025-31134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31134 · Security Note
• https://twitter.com/CVEnew/status/1930351495427334263 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1930431107192795560 · Twitter Post