CVE-2025-31482mediumCWE-352

CVE-2025-31482: fallo de gravedad media en FreshRSS

FreshRSS vulnerable to DoS by malicious feed entry loading logout URL

Publicada el

Seguir esta CVE+ Monitorear FreshRSS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.2%
FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Productos afectados
FreshRSS · FreshRSS
CVEs relacionadas — FreshRSS

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-54593HIGHFreshRSS is vulnerable to RCE attacks by authenticated adminEPSS 0.9%CVE-2022-23497MEDIUMInsecure file access in FreshRSSEPSS 0.9%CVE-2025-58173HIGHFreshRSS vulnerable to authenticated RCE via path traversal inside include()EPSS 0.7%CVE-2025-68932LOWFreshRSS has weak cryptographic randomness in remember-me token and nonce generationEPSS 0.6%CVE-2025-54875CRITICALFreshRSS: Unauthorized creation of admin user when registration is enabledEPSS 0.5%CVE-2025-54592HIGHFreshRSS has Incomplete Session Termination on LogoutEPSS 0.5%