CVE-2025-67713: falha de média gravidade em miniflux v2
Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
miniflux · v2CVEs relacionadas — miniflux v2
No mesmo produto, das mais perigosas para as menos.
CVE-2023-27591HIGHUnauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metricsEPSS 0.8%CVE-2023-27592MEDIUMStored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handlerEPSS 0.6%CVE-2026-55185MEDIUMMiniflux 2: Open Redirect BypassEPSS 0.6%CVE-2025-31483MEDIUMStored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configurationEPSS 0.4%CVE-2026-21885MEDIUMMiniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resourcesEPSS 0.3%