VYPR
← All advisories
High severity8.8OSV Advisory· Published Dec 16, 2025· Updated Jun 17, 2026

CVE-2025-58173

CVE-2025-58173

Description

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed curl_params inside the feed table. Version 1.27.1 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • FreshRSS/FreshrssOSV3 versions
    1.23.0, 1.23.1, 1.24.0, …+ 2 more
    • (no CPE)range: 1.23.0, 1.23.1, 1.24.0, …
    • cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*range: >=1.23.0,<1.27.1
    • (no CPE)range: 1.23.0-1.27.0

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.