CVE-2025-61586: FreshRSS is vulnerable to directory enumeration by setting path in its theme field

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-30 · updated 2026-10-19
Weakness: CWE-22

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.

Affected products

FreshRSS: before 1.27.0 — fixed in 1.27.0

How to fix

Upgrade to a fixed version: FreshRSS 1.27.0. Check the vendor advisory for mitigations.

References

https://github.com/FreshRSS/FreshRSS/commit/6549932d59aef3b72a9da29294af0f30ffb77af5
https://github.com/FreshRSS/FreshRSS/pull/7722
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f

Get alerted when CVE-2025-61586 or the next vulnerability affects your stack