CVE-2025-59948 FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page
Attackers can execute XSS via unsanitized feed content to take over accounts or gain admin privileges if API access is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-59948?
CVE-2025-59948 is a medium-severity cross-site scripting vulnerability in FreshRSS, published on 29 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to be enabled by the instance administrator beforehand for the attack to work as it relies on api/query.php. An account takeover is possible by sending a change password request via the XSS payload / setting UserJS for persistence / stealing the autofill password / displaying a phishing page with a spoofed URL using history.replaceState() If the victim is an administrator, the attacker can also perform administrative actions. This issue is fixed in version 1.27.0.
Weakness: CWE-79
Which versions are affected by CVE-2025-59948?
It affects 1 product.
Products include Freshrss Freshrss.
How do I fix CVE-2025-59948?
No fix has been published for CVE-2025-59948 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-59948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59948 exists.
Other vulnerabilities in FreshRSS
- CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled
- CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout
- CVE-2025-62166 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
- CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information
- CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()
Sources
Also known as GHSA-rwhf-vjjx-gmm9.