FreshRSS hat ein Logout CSRF, das zu DoS via <track src> führt.

The primary impact of this CSRF vulnerability lies in the potential for denial-of-service (DoS). An attacker could craft malicious requests, embedded within a website or email, that, when clicked by an authenticated FreshRSS user, would trigger the user's logout. Repeated or automated exploitation could effectively lock out legitimate users from accessing their RSS feeds. While data exfiltration isn't a direct consequence, a successful DoS attack could disrupt service and impact user productivity. The blast radius is limited to users of FreshRSS, but the self-hosted nature of the application means that individual instances are potentially vulnerable.

Users of FreshRSS who are running versions 1.27.0 or earlier are at risk. This includes individuals and organizations self-hosting FreshRSS instances, particularly those with limited security expertise or those who haven't implemented robust security practices such as CSP.

• php / server:

find /var/www/html/freshrss -type f -name '*.php' -print0 | xargs -0 grep -i '<track src='

• generic web:

curl -I https://your-freshrss-instance.com/ | grep -i 'content-security-policy'

1. 2025-12-18Disclosure

   disclosure

1. Reserviert2025-09-23
2. Veröffentlicht2025-12-18
3. EPSS aktualisiert2026-03-23

The definitive mitigation for CVE-2025-59949 is to upgrade FreshRSS to version 1.27.1 or later. If an immediate upgrade is not feasible due to compatibility concerns or downtime constraints, consider implementing a Content Security Policy (CSP) to restrict the sources from which FreshRSS can load resources. While not a complete fix, this can reduce the attack surface. Additionally, educate users about the risks of clicking suspicious links and entering credentials on untrusted websites. After upgrading, confirm the fix by attempting a logout via a crafted CSRF request and verifying that it does not succeed.