CVE-2025-58173
High
Description
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.
SeverityHigh
CVSS8.8
Exploit probability—
ProductFreshrss
PublishedDec 16, 2025
First seenDec 16, 2025
Weakness typeCWE-20Improper input validationCWE-22Path traversal
How to fix
Update
- freshrss freshrss1.27.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freshrss freshrss | 1.23.0 ≤ v < 1.27.1 | 1.27.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.