CVE-2025-31134

FreshRSS vulnerable before version 1.26.2 due to a directory existence check (ext.php related) that can disclose server information. An attacker could infer presence of older PHP versions or other installed software, aiding further targeted actions. Version 1.26.2 fixes the issue with a patch. Th...

CVE-2025-31134 FreshRSS vulnerable to directory enumeration via ext.php

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server...

CVE-2022-23497

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...

CVE-2022-23497: Exposure of Sensitive Information to an Unauthorized Actor

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...