VULNERABILITY INTELLIGENCE
CVE-2025-58173
CVSS score8.8 HIGH
EPSS probability0.70%
CISA KEVNot currently listed
Published2025-12-16
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.
Weakness classification
- security-advisories@github.com: CWE-20
- nvd@nist.gov: CWE-22
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Issue Tracking, Patch
- security-advisories@github.com — Issue Tracking, Patch
- security-advisories@github.com — Issue Tracking, Patch
- security-advisories@github.com — Exploit, Patch, Vendor Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Patch, Vendor Advisory