Name of the Vulnerable Software and Affected Versions:

FreshRSS versions 1.26.1 and below

Description:

FreshRSS is a free, self-hostable RSS aggregator. An authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. Successful code execution can lead to the exfiltration of user data, including hashed passwords, and potential defacement of the instance. Malicious code can be inserted to steal plaintext passwords.

Recommendations:

Update to version 1.26.2 or later.