Path Traversal in Freshrss
CVE-2025-58173
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (51.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: +0.000
Affected products
- Freshrss — versions >= 1.23.0, < 1.27.1
Weakness classification (CWE)
References
- github.com/FreshRSS/FreshRSS/security/advisories/GHSA-6c8h-w3j5-j293 (Exploit, Patch, Vendor Advisory)
- github.com/FreshRSS/FreshRSS/pull/7878 (Patch, Issue Tracking)
- github.com/FreshRSS/FreshRSS/pull/7971 (Patch, Issue Tracking)
- github.com/FreshRSS/FreshRSS/pull/7979 (Patch, Issue Tracking)
- github.com/FreshRSS/FreshRSS/commit/79604aa4b3051f083d1734bd9e82c6a89d785c5a (Patch)
- github.com/FreshRSS/FreshRSS/commit/dbbae15a8458679db0f4540dacdbdcff9c02ec8c (Patch)
- github.com/FreshRSS/FreshRSS/commit/ee175dd6169a016fc898fac62d046e22c205dec0 (Patch)
Frequently asked questions
- What is CVE-2025-58173?
- CVE-2025-58173 is a high-severity vulnerability in Freshrss, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2025-12-16.
- How severe is CVE-2025-58173?
- High severity. CVSS v3 base score is 8.8 out of 10.