CVE-2025-61586— FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-61586
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Source: NVD (National Vulnerability Database)
Vulnerability Description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
FreshRSS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreshRSS是FreshRSS开源的一个免费的、可自行托管的 RSS 聚合器。 FreshRSS 1.26.3及之前版本存在安全漏洞，该漏洞源于主题字段中路径设置不当，可能导致目录枚举攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-61586
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-61586
请登录查看更多情报信息。
Same Patch Batch · FreshRSS · 2025-09-29 · 7 CVEs total
| CVE-2025-54875 | 9.8 CRITICAL | FreshRSS: Unauthorized creation of admin user when registration is enabled |
| CVE-2025-54591 | 7.5 HIGH | FreshRSS: Unauthenticated users can view default user's information |
| CVE-2025-59948 | 6.7 MEDIUM | FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page |
| CVE-2025-59950 | 6.7 MEDIUM | FreshRSS: Double clickjacking can lead to privilege escalation |
| CVE-2025-54592 | FreshRSS has Incomplete Session Termination on Logout | |
| CVE-2025-57769 | FressRSS: Clickjacking can lead to XSS and/or privilege escalation |
IV. Related Vulnerabilities
Same product: FreshRSS
- CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcryp - CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any u - CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying - CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me to - CVE-2025-59949
FreshRSS has Logout CSRF that Leads to DoS via <track src>
Same vendor: FreshRSS
- CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcryp - CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any u - CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying - CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me to - CVE-2025-59949
FreshRSS has Logout CSRF that Leads to DoS via <track src>
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2025-61586
No comments yet