CVE-2025-32015: FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the <iframe srcdoc> attribute, which leads to cross-site scripting (XSS) by loading an attacker's UserJS inside <script src>. In order to execute the attack, the attacker needs to control one of the victim's feeds and have an account on the FreshRSS instance that the victim is using. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32015?
CVE-2025-32015 is classified as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2025-32015?
To fix CVE-2025-32015, upgrade FreshRSS to version 1.26.2 or later, where the vulnerability has been addressed.
What are the potential impacts of CVE-2025-32015?
The potential impacts of CVE-2025-32015 include unauthorized access to user data and the ability to execute malicious scripts in the context of user sessions.
Who is affected by CVE-2025-32015?
CVE-2025-32015 affects all versions of FreshRSS prior to 1.26.2 that utilize the improper sanitization of HTML within the <iframe srcdoc> attribute.
Is there a known exploit for CVE-2025-32015?
Yes, there is a known exploit for CVE-2025-32015 that allows attackers to load malicious UserJS scripts by leveraging the improper HTML sanitization.