PT-2025-31676 · Freshrss · Freshrss

Inverle · Published 2025-08-01 · Updated 2025-08-01 · CVE-2025-54593

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.1 and below

Description FreshRSS is a free, self-hostable RSS aggregator. An authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. Successful code execution can lead to the exfiltration of user data, including hashed passwords, and potential defacement of the instance. Malicious code can be inserted to steal plaintext passwords.

Recommendations Update to version 1.26.2 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-54593

GHSA-JCWW-48G9-WF57

Affected Products

Freshrss

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54593.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54593 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54593 · Vendor Advisory
• https://github.com/FreshRSS/FreshRSS/commit/dbdadbb4107878d9233f635c31a88afe45957101 · Note
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jcww-48g9-wf57 · Note
• https://github.com/FreshRSS/FreshRSS/pull/7477 · Note
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2 · Note
• https://twitter.com/CVEnew/status/1951355935198175640 · Twitter Post