CVE-2025-61586: fallo de gravedad media en FreshRSS
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.5%
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
FreshRSS · FreshRSSCVEs relacionadas — FreshRSS
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-54593HIGHFreshRSS is vulnerable to RCE attacks by authenticated adminEPSS 0.9%CVE-2022-23497MEDIUMInsecure file access in FreshRSSEPSS 0.9%CVE-2025-58173HIGHFreshRSS vulnerable to authenticated RCE via path traversal inside include()EPSS 0.7%CVE-2025-68932LOWFreshRSS has weak cryptographic randomness in remember-me token and nonce generationEPSS 0.6%CVE-2025-54875CRITICALFreshRSS: Unauthorized creation of admin user when registration is enabledEPSS 0.5%CVE-2025-54592HIGHFreshRSS has Incomplete Session Termination on LogoutEPSS 0.5%