Path Traversal Vulnerability in FreshRSS by FreshRSS

CVE-2025-58173

What is CVE-2025-58173?

In versions 1.23.0 through 1.27.0 of FreshRSS, a path traversal vulnerability within the 'language' user configuration parameter allows unprivileged users to execute administrative functions. This exploitation can result in unauthorized login as an admin, creation of new admin accounts, and manipulation of the database to redirect to an attacker-controlled MySQL server. Such actions ultimately enable the execution of malicious code through carefully manipulated feed parameters in the database. The vulnerability was addressed in version 1.27.1.

References