Log in Start free

Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M

CVE-2025-54593FreshRSS is vulnerable to RCE attacks by authenticated admin

High 7.2

In plain English

A high-severity code injection in FreshRSS from FreshRSS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.9%top 38.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.

Affected products (as reported)

VendorProductVersions
FreshRSS FreshRSS < 1.26.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References