What is the CVSS score of CVE-2025-31134?

CVE-2025-31134 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-31134?

FreshRSS installations below version 1.26.2 expose information about server configuration through directory enumeration, allowing attackers to identify installed software versions and plan targeted…. A patch is available.

Is there a public PoC exploit available for CVE-2025-31134?

Yes, a public proof-of-concept exploit is available for CVE-2025-31134. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-31134?

Within 24 hours: Identify all FreshRSS instances in your environment and document current versions. Within 7 days: Apply vendor patch to upgrade FreshRSS to version 1.26.2 or later across all affected systems. Within 30 days: Conduct post-patch validation and review access logs for signs of prior reconnaissance activity.

PHP CVE-2025-31134

EUVD-2025-16907 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-06-04 security-advisories@github.com

PHP Information Disclosure Freshrss

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16907

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

Patch released

Mar 14, 2026 - 17:29 nvd

Patch available

PoC Detected

Jun 10, 2025 - 15:08 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 20:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

AnalysisAI

FreshRSS versions prior to 1.26.2 suffer from an information disclosure vulnerability that allows unauthenticated remote attackers to enumerate server directories and infer installed software versions (such as PHP versions) without requiring privileges or user interaction. This information leakage can be weaponized for reconnaissance to identify additional attack surfaces. The vulnerability has a CVSS 3.1 score of 7.5 (High) with a network attack vector and no complexity barriers, making it trivially exploitable at scale.

Technical ContextAI

The vulnerability is rooted in CWE-201 (Information Exposure Through an Error Message), where FreshRSS improperly handles directory access requests, allowing attackers to infer the presence or absence of directories through HTTP response patterns or error messages. This is a path traversal/enumeration issue rather than a logic flaw. The affected product is FreshRSS (CPE: cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*), a self-hosted RSS feed aggregator written in PHP. The vulnerability allows attackers to probe for specific directories (e.g., legacy PHP version directories, configuration paths, or third-party software installations) and correlate response codes or message patterns to determine what software versions or components exist on the target system. This information can be used to identify known vulnerabilities in those specific versions.

RemediationAI

Upgrade FreshRSS to version 1.26.2 or later; priority: High; details: The vendor has released version 1.26.2 containing a patch that addresses directory enumeration. Apply this update immediately to all instances. Mitigation (Pre-Patch): Restrict HTTP access via reverse proxy or firewall rules; details: Implement authentication at the reverse proxy/firewall layer (e.g., Basic Auth, OAuth2) to block unauthenticated directory probing. Configure web server (Apache/Nginx) to deny directory listing and return consistent HTTP status codes for all non-existent paths. Mitigation (Pre-Patch): Deploy Web Application Firewall (WAF) rules; details: Use WAF rules to detect and block pattern-based directory enumeration attempts (e.g., probes for common PHP version directories). Detection: Monitor HTTP access logs for directory enumeration patterns; details: Search logs for high volumes of 404 responses to suspicious directory paths (e.g., /php5/, /php7/, /config/, /admin/) from single IP addresses over short time windows.