CVE-2025-31483 Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
An attacker can execute cross-site scripting via the media proxy due to weak Content Security Policy settings in Miniflux.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-31483?
CVE-2025-31483 is a medium-severity cross-site scripting vulnerability in miniflux v2, published on 3 Apr 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.
Weakness: CWE-79
Which versions are affected by CVE-2025-31483?
4 open source packages ship an affected version, including miniflux.app/v2 and miniflux.app.
| Package | Affected | Fixed in |
|---|---|---|
miniflux.app/v2 Go | All versions | 2.2.7 |
miniflux.app/v2 Go | All versions | 2.2.7 |
miniflux.app/v2 Go | All versions | 2.2.7 |
miniflux.app Go | All versions | None |
How do I fix CVE-2025-31483?
Upgrade miniflux.app/v2 to 2.2.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-31483 being exploited?
There is no known exploitation of CVE-2025-31483 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-31483, GHSA-cq88-842x-2jhp, GO-2025-3591, UBUNTU-CVE-2025-31483.