CVE-2025-59949

MediumCVSS 6.5/10Last modified Oct 13, 2026

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
FreshRSS	FreshRSS	< 1.27.1

References

https://github.com/FreshRSS/FreshRSS/pull/7958Issue Tracking, Patch
https://github.com/FreshRSS/FreshRSS/pull/7997Issue Tracking, Patch
https://github.com/FreshRSS/FreshRSS/pull/7999Issue Tracking
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966Exploit, Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966Exploit, Vendor Advisory

Timeline

Published: Dec 18, 2025
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-59954.6Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploita CVE-2025-599505.4FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmat CVE-2025-599519.1Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for CVE-2025-599528.7MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storag CVE-2025-599539.8LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, CVE-2025-599549.8Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection throug CVE-2025-599555.7Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including CVE-2025-599566.5AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS CVE-2025-599576.8An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series CVE-2025-599586.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evo CVE-2025-599595.5An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows CVE-2025-59966.5An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2.