Log in Start free

Vulnerability · Published Dec 15, 2025 · Assigned by GitHub_M

CVE-2025-58173FreshRSS vulnerable to authenticated RCE via path traversal inside include()

High 7.4

In plain English

A high-severity improper input validation in FreshRSS from FreshRSS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 4.0)7.4High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.

Affected products (as reported)

VendorProductVersions
FreshRSS FreshRSS >= 1.23.0, < 1.27.1

Weakness: CWE-20, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References