CVE-2026-55185: Miniflux v2

Medium severity, CVSS 5.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.

Affected products

• Miniflux v2: before 2.3.1 (fixed in 2.3.1)

Published 2026-08-21. Last modified 2026-09-30.