Vulnerability · Published Sep 29, 2025 · Assigned by GitHub_M
CVE-2025-61586FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium 6.9
In plain English
A medium-severity path traversal in FreshRSS from FreshRSS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.5%top 60.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f x_refsource_CONFIRM
- https://github.com/FreshRSS/FreshRSS/pull/7722 x_refsource_MISC
- https://github.com/FreshRSS/FreshRSS/commit/6549932d59aef3b72a9da29294af0f30ffb77af5 x_refsource_MISC