← Back

CVE-2025-31482

nvd nist
Published: Jun 4, 2025Modified: Aug 12, 2025

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Exploitability: 2.8 / Impact: 1.4
Source: security-advisories@github.com (Secondary)

Description

FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.

Affected (1)

Products: Freshrss: Freshrss
Freshrss
1 product
Freshrss
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Freshrss
Before 1.26.2

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

Source: security-advisories@github.com
ExploitVendor Advisory

Timeline

No history available yet.