CVE-2025-54593

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.

• CWE-94

• https://github.com/FreshRSS/FreshRSS/commit/dbdadbb4107878d9233f635c31a88afe45957101Patch
• https://github.com/FreshRSS/FreshRSS/pull/7477Issue Tracking
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2Release Notes
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jcww-48g9-wf57Exploit, Vendor Advisory

Published

Aug 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54588Envoy is an open source L7 proxy and communication bus desig…7.5
• CVE-2025-54589Copyparty is a portable file server. In versions 1.18.6 and …6.1
• CVE-2025-5459A user with specific node group editing permissions and a sp…8.8
• CVE-2025-54590webfinger.js is a TypeScript-based WebFinger client that run…6.9
• CVE-2025-54591FreshRSS is a free, self-hostable RSS aggregator. Versions 1…7.5
• CVE-2025-54592FreshRSS is a free, self-hostable RSS aggregator. Versions 1…9.8
• CVE-2025-54594react-native-bottom-tabs is a library of Native Bottom Tabs …9.1
• CVE-2025-54595Pearcleaner is a free, source-available and fair-code licens…7.3
• CVE-2025-54596Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025…4.3
• CVE-2025-54597LinuxServer.io Heimdall before 2.7.3 allows XSS via the q pa…6.1
• CVE-2025-54598The Bevy Event service through 2025-07-22, as used for eBay …6.5
• CVE-2025-54599The Bevy Event service through 2025-07-22, as used for eBay …7.5