PT-2025-50562 · Miniflux+1 · Miniflux+1

Published 2025-12-10 · Updated 2026-01-06 · CVE-2025-67713

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Miniflux versions 2.2.14 and below

Description Miniflux is an open source feed reader susceptible to an open redirect issue. Specifically, versions 2.2.14 and earlier incorrectly handle the redirect url parameter when url.Parse(...).IsAbs() returns false, creating a potential for phishing attacks after a user logs in. Protocol-relative URLs, such as //ikotaslabs.com, bypass the safety check due to their empty scheme, enabling redirects to attacker-controlled websites. The issue is resolved in version 2.2.15. The vulnerable parameter is redirect url.

Recommendations Update to version 2.2.15 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-67713

GHSA-WQV2-4WPG-8HC9

GO-2025-4226

SUSE-SU-2026:0037-1

Affected Products

Debian

Miniflux

References · 95

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67713.json · Exploit
• https://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7 · Patch
• https://github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67713 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-67713 · Security Note
• https://osv.dev/vulnerability/GHSA-wqv2-4wpg-8hc9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-67713 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-67713 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-67713 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4226 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67713 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67713 · Vendor Advisory
• https://github.com/miniflux/v2 · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note