QwikSec

Security Database

CVE

CWE

Training

CVE-2025-54593

Published: Aug 1, 2025

Modified: Aug 1, 2025

PUBLISHED

CVSS v3.1

7.2

HIGH

Description

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.

Vendor	Product	Versions
FreshRSS	FreshRSS	affected `< 1.26.2`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jcww-48g9-wf57

x_refsource_CONFIRM

https://github.com/FreshRSS/FreshRSS/pull/7477

x_refsource_MISC

https://github.com/FreshRSS/FreshRSS/commit/dbdadbb4107878d9233f635c31a88afe45957101

x_refsource_MISC

https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.