ByteOS Network

NVD Vulnerability Details :

CVE-2025-31134

Analyzed

Source-security-advisories@github.com

Published At-04 Jun, 2025 | 20:15

Updated At-10 Jun, 2025 | 15:08

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	5.5	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

freshrss>>freshrss>>Versions before 1.26.2(exclusive)

cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-201	Primary	security-advisories@github.com
NVD-CWE-Other	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/FreshRSS/FreshRSS/commit/4568111c00813756a3a34a381d684b8354fc4438	security-advisories@github.com	Patch
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65	security-advisories@github.com	Exploit Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History