What is CVE-2025-31134?

CVE-2025-31134 is a high-severity vulnerability in Freshrss, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 7.5/10. Published 2025-06-04.

How severe is CVE-2025-31134?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2025-31134 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Freshrss

CVE-2025-31134

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

EPSS: 0.004 (32.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Freshrss — versions < 1.26.2

Weakness classification (CWE)

CWE-201 — Insertion of Sensitive Information into Sent Data

Public proof-of-concept exploits

seyrenus/trace-release

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-31134?: CVE-2025-31134 is a high-severity vulnerability in Freshrss, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 7.5/10. Published 2025-06-04.
How severe is CVE-2025-31134?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2025-31134 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.