CVE-2025-46339: FreshRSS vulnerable to favicon cache poisoning via proxy
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not including the following variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favicon of a given feed by simply intercepting the response of the feed, and changing the website URL to one where a threat actor controls the feed favicon. Feed favicons can be replaced for all users by anyone. Version 1.26.2 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46339?
CVE-2025-46339 is considered a high-severity vulnerability due to the potential for favicon poisoning.
How do I fix CVE-2025-46339?
To fix CVE-2025-46339, update to FreshRSS version 1.26.2 or later.
What impact does CVE-2025-46339 have on FreshRSS users?
CVE-2025-46339 allows attackers to manipulate feed favicons by exploiting insecure feed configurations.
Is CVE-2025-46339 a remote attack vector?
Yes, CVE-2025-46339 can be exploited remotely if proper security measures are not in place.
What is the recommended security practice concerning CVE-2025-46339?
Always ensure SSL verification is enabled and keep FreshRSS updated to avoid vulnerabilities like CVE-2025-46339.