CVE-2025-46339 FreshRSS vulnerable to favicon cache poisoning via proxy

What is CVE-2025-46339?

CVE-2025-46339 is a medium-severity vulnerability in FreshRSS, published on 4 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not including the following variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favicon of a given feed by simply intercepting the response of the feed, and changing the website URL to one where a threat actor controls the feed favicon. Feed favicons can be replaced for all users by anyone. Version 1.26.2 fixes the issue.

Weakness: CWE-349

Which versions are affected by CVE-2025-46339?

It affects 1 product.

Products include Freshrss Freshrss.

How do I fix CVE-2025-46339?

No fix has been published for CVE-2025-46339 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-46339 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46339 exists.

Other vulnerabilities in FreshRSS

• CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled Critical 9.8
• CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout High 8.8
• CVE-2025-62166 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens High 7.5
• CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information High 7.5
• CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include() High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8f79-3q3w-43c4.