CVE-2025-46341: SSRF in FreshRSS Feed Aggregator

The SSRF vulnerability in FreshRSS allows an attacker to craft malicious requests that the application will then forward to internal or external resources. Specifically, when FreshRSS is behind a reverse proxy using HTTP authentication, an attacker can leverage the Remote-User or X-WebAuth-User headers to impersonate any user. Successful exploitation requires the attacker to know the IP address of the proxied FreshRSS instance and the administrator's username, along with having an account on the instance. This could lead to unauthorized access to sensitive internal services and data, potentially compromising the entire system. The impact is amplified if the internal services accessed contain sensitive information or provide administrative functionality.

1. Reserved2025-04-22
2. Published2025-06-04
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-46341 is to upgrade FreshRSS to version 1.26.2 or later. If upgrading immediately is not feasible, consider implementing stricter HTTP header validation on the reverse proxy to prevent the injection of malicious Remote-User or X-WebAuth-User headers. Additionally, review and restrict access to internal services to minimize the potential impact of a successful SSRF attack. After upgrading, verify the fix by attempting to add a feed with a crafted URL designed to trigger the SSRF vulnerability; the request should be rejected.