Arbitrary Code Execution Vulnerability in FreshRSS by FreshRSS

CVE-2025-54593

What is CVE-2025-54593?

FreshRSS, a self-hosted RSS aggregator, is vulnerable to an arbitrary code execution issue, specifically in versions up to 1.26.1. An attacker with administrator access can exploit this vulnerability by altering the update URL to direct it towards a malicious server. Once the update is executed, the attacker can run arbitrary code on the server, potentially leading to unauthorized access and manipulation of user data. This includes the exfiltration of sensitive information such as hashed passwords and the possibility of defacing the instance, depending on file permissions. To mitigate this risk, users are advised to upgrade to version 1.26.2, where the vulnerability has been addressed.

References