PT-2025-39919 · Freshrss · Freshrss

Inverle · Published 2025-09-29 · Updated 2025-09-30 · CVE-2025-61586

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below

Description FreshRSS is susceptible to directory enumeration. By manipulating the theme field with a specific path, an attacker can determine the existence of directories on the server, potentially gaining additional information.

Recommendations Update to version 1.27.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-61586

GHSA-W35P-P867-QR4F

Affected Products

Freshrss

References · 10

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61586.json · Exploit
• https://github.com/FreshRSS/FreshRSS/pull/7722 · Patch
• https://github.com/FreshRSS/FreshRSS/commit/6549932d59aef3b72a9da29294af0f30ffb77af5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-61586 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61586 · Vendor Advisory
• https://t.me/cveNotify/136901 · Telegram Post
• https://twitter.com/CVEnew/status/1972805767011938656 · Twitter Post
• https://t.me/CVEtracker/33681 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1972897601201521093 · Twitter Post