CVE-2025-57769

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/FreshRSS/FreshRSS/pull/7677	Patch
https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0	Release Notes
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw	Exploit Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) FreshRSS es un agregador RSS gratuito y autoalojable. Las versiones 1.26.3 e inferiores contienen una vulnerabilidad donde una página especialmente diseñada puede engañar a un usuario para que ejecute código JS arbitrario o para promocionar a un usuario en FreshRSS al ocultar elementos de la interfaz de usuario en iframes. Si es posible incrustar un iframe autenticado, esto puede conducir a una escalada de privilegios mediante la ocultación del botón de promoción de usuario en la interfaz de administración o XSS al engañar al usuario para que arrastre contenido al área de texto de UserJS. Esto está corregido en la versión 1.27.0.

Information

Published : 2025-09-29 22:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-57769

Mitre link : CVE-2025-57769

CVE.ORG link : CVE-2025-57769

JSON object : View

Products Affected

freshrss

freshrss

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-57769", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57769", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T14:51:12.226653Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreshRSS", "product": "FreshRSS", "versions": [{"status": "affected", "version": "< 1.27.0"}]}]}], "published": "2025-09-29T22:15:36.463", "references": [{"url": "https://github.com/FreshRSS/FreshRSS/pull/7677", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-wm5p-7pr7-c8rw", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-1021"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0"}, {"lang": "es", "value": "FreshRSS es un agregador RSS gratuito y autoalojable. Las versiones 1.26.3 e inferiores contienen una vulnerabilidad donde una p\u00e1gina especialmente dise\u00f1ada puede enga\u00f1ar a un usuario para que ejecute c\u00f3digo JS arbitrario o para promocionar a un usuario en FreshRSS al ocultar elementos de la interfaz de usuario en iframes. Si es posible incrustar un iframe autenticado, esto puede conducir a una escalada de privilegios mediante la ocultaci\u00f3n del bot\u00f3n de promoci\u00f3n de usuario en la interfaz de administraci\u00f3n o XSS al enga\u00f1ar al usuario para que arrastre contenido al \u00e1rea de texto de UserJS. Esto est\u00e1 corregido en la versi\u00f3n 1.27.0."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5043EB51-EC2A-4735-A3E0-9E07DA94ECF7", "versionEndExcluding": "1.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}