What’s Vulnerable › Vulnerabilities

CVE-2025-57769: FressRSS: Clickjacking can lead to XSS and/or privilege escalation

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-29 · updated 2026-10-19
• Weakness: CWE-79

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0

Affected products

• FreshRSS: before 1.27.0 — fixed in 1.27.0

How to fix

Upgrade to a fixed version: FreshRSS 1.27.0. Check the vendor advisory for mitigations.

References

• https://github.com/FreshRSS/FreshRSS/pull/7677
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw

Get alerted when CVE-2025-57769 or the next vulnerability affects your stack