CVE-2025-57769 FressRSS: Clickjacking can lead to XSS and/or privilege escalation

Medium 5.3 Published 29 Sep 2025 Updated 30 Sep 2025

Attackers can use clickjacking to execute arbitrary JavaScript or escalate privileges in FreshRSS by obscuring UI elements.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-57769?

CVE-2025-57769 is a medium-severity cross-site scripting vulnerability in FreshRSS, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0

Weakness: CWE-79, CWE-1021

Which versions are affected by CVE-2025-57769?

It affects 1 product.

Products include Freshrss Freshrss.

How do I fix CVE-2025-57769?

No fix has been published for CVE-2025-57769 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-57769 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57769 exists.

Sources

Also known as GHSA-wm5p-7pr7-c8rw.