CVE-2025-61586 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing att…
Medium CVSS: 6.9

CVE-2025-61586

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
Vendor
Freshrss
Product
Freshrss
CWE
CWE-22
Yayın Tarihi
2025-09-30 04:44:53
Güncelleme
2025-10-03 15:39:40
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-22 Freshrss MEDIUM Freshrss 2025

Referanslar

https://github.com/FreshRSS/FreshRSS/commit/6549932d59aef3b72a9da29294af0f30ffb77af5 https://github.com/FreshRSS/FreshRSS/pull/7722 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f