What’s Vulnerable › Vulnerabilities

CVE-2025-31134: FreshRSS vulnerable to directory enumeration via ext.php

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-04 · updated 2026-06-17
• Weakness: CWE-201

Description

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

Affected products

• FreshRSS: before 1.26.2 — fixed in 1.26.2

How to fix

Upgrade to a fixed version: FreshRSS 1.26.2. Check the vendor advisory for mitigations.

References

• https://github.com/FreshRSS/FreshRSS/commit/4568111c00813756a3a34a381d684b8354fc4438
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65

Get alerted when CVE-2025-31134 or the next vulnerability affects your stack