CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()

High 7.4 Published 15 Dec 2025 Updated 16 Dec 2025

Authenticated attackers can exploit path traversal in language settings to gain admin access and execute arbitrary code via malicious database configurations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-58173?

CVE-2025-58173 is a high-severity path traversal vulnerability in FreshRSS, published on 15 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.

Weakness: CWE-22, CWE-20

Which versions are affected by CVE-2025-58173?

It affects 1 product.

Products include Freshrss Freshrss.

How do I fix CVE-2025-58173?

No fix has been published for CVE-2025-58173 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-58173 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58173 exists.

Sources

Also known as GHSA-6c8h-w3j5-j293.