PT-2025-51321 · Freshrss · Freshrss

Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-58173

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.23.0 through 1.27.0

Description FreshRSS is a self-hosted RSS feed aggregator. Versions 1.23.0 through 1.27.0 contain a path traversal issue within the language user configuration parameter. This allows an unprivileged user to invoke install.php and perform administrative actions. These actions include logging in as the administrator, creating a new administrator user, or configuring the database to connect to an attacker-controlled MySQL server. An attacker could then execute code within FreshRSS by setting malicious feed curl params inside the feed table. The install.php file is used for administrative tasks.

Recommendations Update to version 1.27.1 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

CVE-2025-58173

GHSA-6C8H-W3J5-J293

Affected Products

Freshrss

References · 13

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-6c8h-w3j5-j293 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58173.json · Exploit
• https://github.com/FreshRSS/FreshRSS/pull/7971 · Patch
• https://github.com/FreshRSS/FreshRSS/commit/79604aa4b3051f083d1734bd9e82c6a89d785c5a#diff-49280171b6e7964e21a0270427e56eacb47b8ac562593a01ad4bc74b49f840c7R135 · Patch
• https://github.com/FreshRSS/FreshRSS/commit/ee175dd6169a016fc898fac62d046e22c205dec0#diff-6ebff7743ede829cf5a7f0e4566b42023a2d4779cc8d7e96fefec116f2292174R190-R194 · Patch
• https://github.com/FreshRSS/FreshRSS/pull/7878 · Patch
• https://github.com/FreshRSS/FreshRSS/pull/7979 · Patch
• https://github.com/FreshRSS/FreshRSS/commit/dbbae15a8458679db0f4540dacdbdcff9c02ec8c#diff-63f610c36d0f2555c1787f6d0804f46f4df6e0f918dfe03408309039abf6efebL85-L88 · Patch
• https://osv.dev/vulnerability/CVE-2025-58173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58173 · Security Note
• https://twitter.com/VulmonFeeds/status/2000884012361867533 · Twitter Post
• https://twitter.com/CVEnew/status/2002857352597487705 · Twitter Post
• https://t.me/CVEtracker/39870 · Telegram Post