CVE-2025-58173: Freshrss

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.

Affected products

• Freshrss Freshrss: from 1.23.0, before 1.27.1 (fixed in 1.27.1)

Published 2025-12-16. Last modified 2026-06-17.