FreshRSS is vulnerable to RCE attacks by authenticated admin

Description

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.

Scores

EPSS (exploitation in 30 days)

0.94% · top 39% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• CWE-94: Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• FreshRSS · FreshRSS

  • affected < 1.26.2

References (4)

• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jcww-48g9-wf57 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/FreshRSS/FreshRSS/pull/7477 (opens in a new tab)x_refsource_MISC
• https://github.com/FreshRSS/FreshRSS/commit/dbdadbb4107878d9233f635c31a88afe45957101 (opens in a new tab)x_refsource_MISC
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-54593](https://trackcve.app/badge/CVE-2025-54593.svg)](https://trackcve.app/cve/CVE-2025-54593)

Record last updated 1 Aug 2025, 18:32 UTC.