CVE-2025-31134

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-311355.3Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be acceCVE-2025-311365.4FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This ocCVE-2025-311377.5React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React RouterCVE-2025-311386.6tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where userCVE-2025-311396.5In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logCVE-2025-31149.4Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate securiCVE-2025-311406.1In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageCVE-2025-311417.5In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles pageCVE-2025-311446.9Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, aCVE-2025-311466.1Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3:CVE-2025-311475.3Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31159.8Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Addit