PT-2025-23853 · Freshrss · Freshrss

Inverle · Published 2025-06-04 · Updated 2025-06-04 · CVE-2025-32015

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.26.2

Description The issue is related to improper HTML sanitization inside the <iframe srcdoc> attribute, leading to cross-site scripting (XSS) by loading an attacker's UserJS inside <script src>. To execute the attack, the attacker needs to control one of the victim's feeds and have an account on the FreshRSS instance that the victim is using. This could allow an attacker to gain access to the victim's account. If the victim is an admin, it would be possible to delete all users or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS.

Recommendations For versions prior to 1.26.2, update to version 1.26.2 to resolve the issue. As a temporary workaround, consider restricting access to the <iframe srcdoc> attribute or disabling the use of UserJS inside <script src> until the patch is applied. Restricting feed control and account access can also minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-32015

GHSA-WGRQ-MCWC-8F8V

Affected Products

Freshrss

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32015.json · Exploit
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wgrq-mcwc-8f8v · Vendor Advisory
• https://github.com/FreshRSS/FreshRSS/commit/54e2f9107d03c5b3bb260f38fdb2736bce449fd4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32015 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32015 · Vendor Advisory
• https://twitter.com/CVEnew/status/1930361394735759856 · Twitter Post
• https://t.me/cvetracker/25434 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930413191953031263 · Twitter Post