CVE-2025-46339

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not including the following variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favicon of a given feed by simply intercepting the response of the feed, and changing the website URL to one where a threat actor controls the feed favicon. Feed favicons can be replaced for all users by anyone. Version 1.26.2 fixes the issue.

• CWE-349

• https://github.com/FreshRSS/FreshRSS/commit/3776e1e48f33e80eb4b674bb64b419caf3b5a4e2Patch
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8f79-3q3w-43c4Exploit, Vendor Advisory

Published

Jun 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46333z2d is a pure Zig 2D graphics library. Versions of z2d after…7.3
• CVE-2025-46334Git GUI allows you to use the Git source control management …8.6
• CVE-2025-46335Mobile Security Framework (MobSF) is a security research pla…5.4
• CVE-2025-46336Rack::Session is a session management implementation for Rac…4.2
• CVE-2025-46337ADOdb is a PHP database class library that provides abstract…10
• CVE-2025-46338Audiobookshelf is a self-hosted audiobook and podcast server…6.1
• CVE-2025-4634The web portal on airpointer 2.4.107-2 was vulnerable local …4.1
• CVE-2025-46340Misskey is an open source, federated social media platform. …5.4
• CVE-2025-46341FreshRSS is a self-hosted RSS feed aggregator. Prior to vers…7.1
• CVE-2025-46342Kyverno is a policy engine designed for cloud native platfor…8.2
• CVE-2025-46343n8n is a workflow automation platform. Prior to version 1.90…5.4
• CVE-2025-46344The Auth0 Next.js SDK is a library for implementing user aut…4.9