CVE-2025-59948

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to be enabled by the instance administrator beforehand for the attack to work as it relies on api/query.php. An account takeover is possible by sending a change password request via the XSS payload / setting UserJS for persistence / stealing the autofill password / displaying a phishing page with a spoofed URL using history.replaceState() If the victim is an administrator, the attacker can also perform administrative actions. This issue is fixed in version 1.27.0.

• CWE-79

• https://github.com/FreshRSS/FreshRSS/commit/7df6c201f2e6a6521d20718dfd8d9794c7437d1fPatch
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0Release Notes
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-rwhf-vjjx-gmm9Exploit, Vendor Advisory
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-rwhf-vjjx-gmm9Exploit, Vendor Advisory

Published

Sep 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59942go-f3 is a Golang implementation of Fast Finality for Fileco…7.5
• CVE-2025-59943phpMyFAQ is an open source FAQ web application. Versions 4.0…9.8
• CVE-2025-59944Cursor is a code editor built for programming with AI. Versi…9.8
• CVE-2025-59945SysReptor is a fully customizable pentest reporting platform…8.1
• CVE-2025-59946NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. P…7.5
• CVE-2025-59947NanoMQ is a messaging broker/bus for IoT Edge & SDV. Version…9
• CVE-2025-59949FreshRSS is a free, self-hostable RSS aggregator. Versions p…6.5
• CVE-2025-5995Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29…4.6
• CVE-2025-59950FreshRSS is a free, self-hostable RSS aggregator. In version…5.4
• CVE-2025-59951Termix is a web-based server management platform with SSH te…9.1
• CVE-2025-59952MinIO Java SDK is a Simple Storage Service (aka S3) client t…8.7
• CVE-2025-59954Knowage is an open source analytics and business intelligenc…9.8