CVE-2026-55185 in Miniflux
Summary
by MITRE • 08/21/2026
Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Miniflux versions prior to 2.3.1 represents a critical flaw in how the application handles URL redirection during authentication flows. As an open-source feed reader, Miniflux relies on robust input validation and secure redirect mechanisms to protect user sessions and data integrity. The specific defect resides within the internal/urllib/url.go module, specifically affecting the IsRelativePath function which is responsible for validating whether a provided target URL is relative or absolute before processing redirects. This function failed to correctly identify URLs containing backslashes as non-relative paths because the underlying Go standard library's net/url package treats backslashes in certain contexts as valid path characters rather than delimiters that would trigger an error or distinct classification.
This technical oversight creates a significant security gap due to the discrepancy between server-side parsing and client-side browser behavior. When an unauthenticated attacker supplies a redirect_url parameter containing a backslash, such as http://evil.com\@example.com, the Go URL parser on the Miniflux server interprets this string as a valid relative path or fails to flag it as an absolute external domain during its internal checks. Consequently, the application proceeds with the redirection logic without triggering the expected security controls designed to prevent open redirects to arbitrary hosts. However, when the victim's browser receives this redirect response, standard web browser behavior dictates that backslashes in URLs are normalized into forward slashes for compatibility and consistency across different operating systems and protocols. This normalization transforms the malicious payload into a standard absolute URL pointing directly to an attacker-controlled domain.
The operational impact of this vulnerability is severe, as it enables unauthenticated attackers to perform open redirect attacks against users interacting with the Miniflux instance. By leveraging the login flow or any other endpoint that accepts a redirect parameter, an attacker can craft URLs that appear legitimate to the server but resolve to malicious destinations in the client's browser. This capability facilitates phishing campaigns where victims are redirected from what appears to be a trusted application domain to a fraudulent site designed to steal credentials, install malware, or execute cross-site scripting attacks. The lack of authentication requirement for exploitation means that any user visiting a crafted link is at risk, significantly expanding the attack surface beyond just compromised accounts to include all potential visitors.
From a classification perspective, this vulnerability aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect). It also maps to MITRE ATT&CK technique T1566.002, specifically Spearphishing Link, as the redirect serves as a delivery mechanism for social engineering attacks by masking the true destination of the link behind a trusted domain context. The root cause is rooted in CWE-749, which relates to improper restriction of operations within the bounds of a memory buffer or resource, though more accurately it falls under CWE-20 Improper Input Validation where the application fails to adequately sanitize or validate user-supplied input before processing it for security-critical decisions like redirection.
To mitigate this vulnerability and prevent similar issues in future development cycles, immediate action must be taken by upgrading Miniflux to version 2.3.1 or later, which includes patches that correctly handle backslash normalization and enforce stricter validation on redirect targets. For organizations unable to upgrade immediately, implementing a web application firewall rule to block requests containing backslashes within URL parameters can provide temporary relief. Furthermore, developers should adopt a whitelist approach for allowed redirect domains rather than relying solely on blacklist or relative-path checks, as these are often susceptible to bypass techniques involving encoding variations and parser inconsistencies across different languages and libraries. Ensuring that all external redirects undergo strict validation against an allowlist of trusted hosts is the most effective long-term defense strategy against open redirect vulnerabilities.