CVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator.
Published Dec 16, 2025 · updated Oct 14, 2026 · freshrss freshrss
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed inside the table. Version 1.27.1 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 16, 2025 · NIST NVD
Detected
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in
Oct 14, 2026 · NIST NVD
Updated
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in
Affected
- cpe freshrss/freshrssversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-58173
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-58173
30-day exploitation probability 0.7%
first.org - NIST NVDVulnerability recordCVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the user configuration parameter, it's possible to call and perform various administrative actions as an unprivileged user. These actions inclu
nvd.nist.gov