Back to Database
Status published
Medium
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Vulnerability Description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61586
Credits & Attribution
No credits recorded in the NVD database.
References
More from FreshRSS
View All →CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
Low
2.9
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High
8.2
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Medium
4.3
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High
7.5
CVE-2025-59950
FreshRSS: Double clickjacking can lead to privilege escalation
Medium
6.7
Affected Vendor
FreshRSS
View all reports →Affected Software
FreshRSS
Vulnerable Versions:
< 1.27.0
Timeline
Official Publish:
September 29th, 2025
Last Modified:
September 30th, 2025
Added to House:
July 22nd, 2026