CVE-2025-54593: RCE in FreshRSS Self-Hosted RSS Aggregator

Successful exploitation of CVE-2025-54593 allows an attacker to gain complete control over the FreshRSS server. By modifying the update URL to a malicious server, an administrator can trigger the execution of arbitrary code during the update process. This could involve downloading and executing a malicious script, enabling the attacker to steal sensitive data, including hashed passwords, deface the website, or establish a persistent backdoor. The blast radius extends to any data stored within the FreshRSS instance, and potentially to other systems accessible from the compromised server.

1. Reserved2025-07-25
2. Published2025-08-01
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-54593 is to immediately upgrade FreshRSS to version 1.26.2 or later. If upgrading is not immediately feasible, consider restricting administrator access to the FreshRSS instance and closely monitoring update logs for any suspicious activity. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to block requests with suspicious update URLs could provide an additional layer of defense. After upgrading, verify the fix by attempting an update and confirming that the server does not execute any unauthorized code.