CVE-2026-21885

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

• CWE-918

• https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wpExploit, Vendor Advisory
• https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wpExploit, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2188A vulnerability was determined in UTT 进取 521G 3.1.1-190816. …7.3
• CVE-2026-21880Kanboard is project management software focused on Kanban me…5.3
• CVE-2026-21881Kanboard is project management software focused on Kanban me…9.1
• CVE-2026-21882theshit is a command-line utility that automatically detects…8.4
• CVE-2026-21883Bokeh is an interactive visualization library written in Pyt…5.4
• CVE-2026-21884React Router is a router for React. In @remix-run/react vers…8.2
• CVE-2026-21886OpenCTI is an open source platform for managing cyber threat…8.1
• CVE-2026-21887OpenCTI is an open source platform for managing cyber threat…7.7
• CVE-2026-21888NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-21889Weblate is a web based localization tool. Prior to 5.15.2, t…7.5
• CVE-2026-2189A vulnerability was identified in itsourcecode School Manage…9.8
• CVE-2026-21891ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.8