CVE-2025-31134

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

CVSS v4.0

5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2025-06-04

Proof-of-concept exploits (1)

• FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65

References

• CVE Record
• NVD entry

Related

• CVE-2023-22481
• CVE-2025-31136
• CVE-2025-31482
• CVE-2025-32015
• CVE-2025-46341
• CVE-2025-54593