CVE-2025-54593 FreshRSS is vulnerable to RCE attacks by authenticated admin

What is CVE-2025-54593?

CVE-2025-54593 is a high-severity code injection vulnerability in FreshRSS, published on 1 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.

Weakness: CWE-94

Which versions are affected by CVE-2025-54593?

It affects 1 product.

Products include Freshrss Freshrss.

How do I fix CVE-2025-54593?

No fix has been published for CVE-2025-54593 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-54593 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54593 exists.

Other vulnerabilities in FreshRSS

• CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled Critical 9.8
• CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout High 8.8
• CVE-2025-62166 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens High 7.5
• CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information High 7.5
• CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include() High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jcww-48g9-wf57.