CVE-2025-57769

MEDIUM EPSS 17.0%
Published Sep 29, 20259mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 4.0
Medium
Find Similar
Published Sep 29, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0

CVSS Details

Base Score
5.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
17.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-1021
CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
freshrssfreshrss* <1.27.0

References 3

  • github.com https://github.com/FreshRSS/FreshRSS/pull/7677
    Patch
  • github.com https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0
    Release Notes
  • github.com https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/FreshRSS/FreshRSS/pull/7677
    Patch