Description
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.
References (4)
Core 4
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jcww-48g9-wf57
Issue Tracking x_refsource_misc
https://github.com/FreshRSS/FreshRSS/pull/7477
Patch x_refsource_misc
https://github.com/FreshRSS/FreshRSS/commit/dbdadbb4107878d9233f635c31a88afe45957101
Release Notes x_refsource_misc
https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2
Scores
CVSS v3
7.2
EPSS
0.0050
EPSS Percentile
65.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (1)
freshrss/freshrss
< 1.26.2
Published
Aug 01, 2025
Tracked Since
Feb 18, 2026