PT-2025-23855 · Freshrss · Freshrss

Inverle · Published 2025-06-04 · Updated 2025-06-04 · CVE-2025-46339

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.26.2

Description The issue allows an attacker to poison feed favicons by manipulating the feed URL and proxy settings, potentially replacing favicons for all users. This is possible because the favicon hash computation does not include the proxy address, proxy protocol, and SSL verification settings. An attacker can intercept the feed response and change the website URL to a controlled feed favicon.

Recommendations For versions prior to 1.26.2, update to version 1.26.2 to resolve the issue. As a temporary workaround, consider restricting access to the proxy settings and ensuring SSL verification is enabled for all feeds. Avoid using the proxy feature with untrusted feeds until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-349

Related Identifiers

CVE-2025-46339

GHSA-8F79-3Q3W-43C4

Affected Products

Freshrss

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46339.json · Exploit
• https://github.com/FreshRSS/FreshRSS/commit/3776e1e48f33e80eb4b674bb64b419caf3b5a4e2 · Patch
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8f79-3q3w-43c4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46339 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46339 · Vendor Advisory
• https://twitter.com/CVEnew/status/1930361392047239294 · Twitter Post
• https://t.me/cvetracker/25438 · Telegram Post