CVE-2025-58173High· 8.8▾ TwilightFreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed curl_params inside the feed table. Version 1.27.1 fixes the issue.
freshrss >= 1.23.0, < 1.27.1Upgrade past the affected range:
freshrss 1.27.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59949Medium· 5.3FreshRSS is a free, self-hostable RSS aggregator
CVE-2025-68148Medium· 4.3FreshRSS is a free, self-hostable RSS aggregator
CVE-2025-68932Critical· 9.8FreshRSS is a free, self-hostable RSS aggregator
CVE-2021-3580High· 7.5A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext
CVE-2021-36325High· 7.5Dell BIOS contains an improper input validation vulnerability
CVE-2021-36323High· 7.5Dell BIOS contains an improper input validation vulnerability