CVE-2025-31483: falha de média gravidade em miniflux v2
Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.4%
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
miniflux · v2CVEs relacionadas — miniflux v2
No mesmo produto, das mais perigosas para as menos.
CVE-2023-27591HIGHUnauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metricsEPSS 0.8%CVE-2023-27592MEDIUMStored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handlerEPSS 0.6%CVE-2026-55185MEDIUMMiniflux 2: Open Redirect BypassEPSS 0.6%CVE-2026-21885MEDIUMMiniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resourcesEPSS 0.3%CVE-2025-67713MEDIUMMiniflux 2 has an Open Redirect via protocol-relative `redirect_url`EPSS 0.2%