CVE-2025-31483: Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Summary
Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window.
Impact
A malicious feed added to Miniflux can execute arbitrary JavaScript in the user's browser when opening external resources, such as proxified images, in a new tab or window.
Mitigation
The CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;.
Upgrade to Miniflux >= 2.2.7
Credit RyotaK (GMO Flatt Security Inc.) with takumi-san.ai
Other sources
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31483?
CVE-2025-31483 has been classified as a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-31483?
To fix CVE-2025-31483, update to Miniflux version 2.2.7 or later, which implements a more stringent Content Security Policy for the media proxy.
What impact does CVE-2025-31483 have on Miniflux users?
CVE-2025-31483 can allow attackers to execute cross-site scripting when users open external images, potentially compromising user data.
Is CVE-2025-31483 present in all versions of Miniflux?
CVE-2025-31483 is present in all versions of Miniflux prior to version 2.2.7.
What feature of Miniflux is affected by CVE-2025-31483?
CVE-2025-31483 affects the /proxy/* route in Miniflux, specifically related to the media proxy's Content Security Policy.