FreshRSS up to 1.26.1 Feed Favicon acceptance of extraneous untrusted data with trusted data

Summaryinfo

A vulnerability identified as problematic has been detected in FreshRSS up to 1.26.1. This vulnerability affects unknown code of the component Feed Favicon Handler. This manipulation causes acceptance of extraneous untrusted data with trusted data. This vulnerability is registered as CVE-2025-46339. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in FreshRSS up to 1.26.1 and classified as problematic. Affected by this vulnerability is some unknown functionality of the component Feed Favicon Handler. The manipulation with an unknown input leads to a acceptance of extraneous untrusted data with trusted data vulnerability. The CWE definition for the vulnerability is CWE-349. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. As an impact it is known to affect integrity. The summary by CVE is:

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not including the following variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favicon of a given feed by simply intercepting the response of the feed, and changing the website URL to one where a threat actor controls the feed favicon. Feed favicons can be replaced for all users by anyone. Version 1.26.2 fixes the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-46339 since 04/23/2025. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.26.2 eliminates this vulnerability. Applying the patch 3776e1e48f33e80eb4b674bb64b419caf3b5a4e2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• FreshRSS

Version

• 1.26.0
• 1.26.1

License

• open-source

Website

• Product: https://github.com/FreshRSS/FreshRSS/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion