CVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator.
Published Dec 16, 2025 · updated Oct 14, 2026 · freshrss freshrss
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed inside the table. Version 1.27.1 fixes the issue.
Timeline
Detection, updates, and resolution for this record.
Dec 16, 2025 · NIST NVD
Detected
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in
Oct 14, 2026 · NIST NVD
Updated
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in
Affected
- cpe freshrss/freshrssversion unspecified
Sources
- CVE.orgCVE-2025-58173
Official CVE identifier
cve.org - NIST NVDCVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions inclu
nvd.nist.gov