Directory Traversal Vulnerability in FreshRSS by FreshRSS
CVE-2025-31134

5.5MEDIUM

Key Information:

Vendor

Freshrss

Status
Freshrss
Vendor
CVE Published:
4 June 2025

What is CVE-2025-31134?

FreshRSS, a popular self-hosted RSS feed aggregator, is susceptible to a directory traversal vulnerability prior to version 1.26.2. This issue allows an attacker to ascertain the existence of specific directories on the server, potentially revealing critical system information such as the presence of outdated PHP versions or other installed software. By exploiting this vulnerability, an attacker may gather data that could facilitate further attacks against the server. Enhanced security measures were implemented in version 1.26.2 to address this critical issue.

Affected Version(s)

FreshRSS < 1.26.2

References

https://github.com/FreshRSS/FreshRSS/security/advisories/...
x_refsource_CONFIRM
https://github.com/FreshRSS/FreshRSS/commit/4568111c00813...
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.