CVE-2026-108735: Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal ports and send proxy-style requests to internal services.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Miniflux user can exploit it by configuring the proxy_url for a feed. No user interaction is required after the attacker sets that value.
What access can an attacker gain through exploitation?
The attacker can cause the Miniflux server to send proxy-style requests to loopback or internal hosts. This can be used to probe internal ports and reach services that are not externally accessible.
Does enabling FETCHER_ALLOW_PRIVATE_NETWORKS protection prevent exploitation?
No. The issue bypasses FETCHER_ALLOW_PRIVATE_NETWORKS checks through the per-feed proxy_url setting.
Which versions should be investigated?
Miniflux versions 2.3.0 through 2.3.3 are identified as affected. Review feed proxy_url configurations in those deployments for loopback or internal-host targets.