Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

Draft a new security advisory online, or report security issues to alexandre@alapetite.fr (PGP public key if relevant).

Logout CSRF leads to DoS via <track src>
GHSA-w7f5-8vf9-f966 published Dec 18, 2025 by Alkarex

Moderate
Authenticated RCE via path traversal inside include()
GHSA-6c8h-w3j5-j293 published Dec 15, 2025 by Alkarex

Critical
Directory enumeration by setting path in theme field
GHSA-w35p-p867-qr4f published Sep 27, 2025 by Alkarex

Low
XSS due to lack of CSP on HTML query page
GHSA-rwhf-vjjx-gmm9 published Sep 27, 2025 by Alkarex

Moderate
Unauthorized creation of admin user when registration is enabled
GHSA-h625-ghr3-jppq published Sep 27, 2025 by Alkarex

Critical
Unauthenticated users are able to read information about feeds/tags of the default user
GHSA-jf4v-f8p2-8xvq published Sep 27, 2025 by Alkarex

High
Incomplete Session Termination on Logout in FreshRSS
GHSA-42v4-65f8-5wgr published Sep 27, 2025 by Alkarex

Moderate
Double clickjacking leads to privilege escalation
GHSA-j66v-hvqx-5vh3 published Sep 27, 2025 by Alkarex

Moderate
Admin authenticated RCE <1.26.2
GHSA-jcww-48g9-wf57 published Jul 31, 2025 by Alkarex

High
Clickjacking leads to XSS / privilege escalation
GHSA-wm5p-7pr7-c8rw published Sep 27, 2025 by Alkarex

Low

Learn more about advisories related to FreshRSS/FreshRSS in the GitHub Advisory Database