CVE-2025-61586 FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Attackers can enumerate server directories via the theme field, exposing sensitive server information in FreshRSS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61586?
CVE-2025-61586 is a medium-severity path traversal vulnerability in FreshRSS, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
Weakness: CWE-22
Which versions are affected by CVE-2025-61586?
It affects 1 product.
Products include Freshrss Freshrss.
How do I fix CVE-2025-61586?
No fix has been published for CVE-2025-61586 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-61586 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61586 exists.
Other vulnerabilities in FreshRSS
- CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled
- CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout
- CVE-2025-62166 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
- CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information
- CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()
Sources
Also known as GHSA-w35p-p867-qr4f.