CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/miniflux/v2/commit/c896bafdaa19c3f280b02b1059f84706495f1949
https://github.com/miniflux/v2/pull/4362
https://github.com/miniflux/v2/releases/tag/2.3.1
https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r
https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Miniflux 2 es un lector de feeds de código abierto. Antes de la versión 2.3.1, IsRelativePath en internal/urllib/url.go acepta objetivos de redirección que contienen barras invertidas porque el análisis de URL de Go las trata como caracteres de ruta. La normalización de barras invertidas del navegador las convierte en barras diagonales. Un atacante no autenticado puede proporcionar un valor de redirect_url de este tipo al flujo de inicio de sesión, eludir las comprobaciones de ruta relativa y de host, y redirigir a una víctima a un sitio externo controlado por el atacante. Este problema se solucionó en la versión 2.3.1.

Information

Published : 2026-08-21 21:17

Updated : 2026-10-12 16:10

NVD link : CVE-2026-55185

Mitre link : CVE-2026-55185

CVE.ORG link : CVE-2026-55185

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-55185", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55185", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:46:24.951438Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "miniflux", "product": "v2", "versions": [{"status": "affected", "version": "< 2.3.1"}]}]}], "published": "2026-08-21T21:17:00.563", "references": [{"url": "https://github.com/miniflux/v2/commit/c896bafdaa19c3f280b02b1059f84706495f1949", "source": "security-advisories@github.com"}, {"url": "https://github.com/miniflux/v2/pull/4362", "source": "security-advisories@github.com"}, {"url": "https://github.com/miniflux/v2/releases/tag/2.3.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r", "source": "security-advisories@github.com"}, {"url": "https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1."}, {"lang": "es", "value": "Miniflux 2 es un lector de feeds de c\u00f3digo abierto. Antes de la versi\u00f3n 2.3.1, IsRelativePath en internal/urllib/url.go acepta objetivos de redirecci\u00f3n que contienen barras invertidas porque el an\u00e1lisis de URL de Go las trata como caracteres de ruta. La normalizaci\u00f3n de barras invertidas del navegador las convierte en barras diagonales. Un atacante no autenticado puede proporcionar un valor de redirect_url de este tipo al flujo de inicio de sesi\u00f3n, eludir las comprobaciones de ruta relativa y de host, y redirigir a una v\u00edctima a un sitio externo controlado por el atacante. Este problema se solucion\u00f3 en la versi\u00f3n 2.3.1."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}