CVE-2025-58173: FreshRSS vulnerable to authenticated RCE via path traversal inside include()
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed curlparams inside the feed table. Version 1.27.1 fixes the issue.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58173?
CVE-2025-58173 has a high severity due to the potential for unprivileged users to perform administrative actions.
How do I fix CVE-2025-58173?
To fix CVE-2025-58173, update FreshRSS to a version later than 1.27.0.
What versions of FreshRSS are affected by CVE-2025-58173?
FreshRSS versions 1.23.0 through 1.27.0 are affected by CVE-2025-58173.
What type of vulnerability is CVE-2025-58173?
CVE-2025-58173 is a path traversal vulnerability that allows unauthorized access to administrative functions.
Can CVE-2025-58173 lead to data exposure?
Yes, CVE-2025-58173 can lead to unauthorized data exposure or manipulation due to administrative actions being accessible to unprivileged users.