FreshRSS CVE-2025-58173

Exploitation requires a valid low-privilege (non-admin) account on the FreshRSS instance (CVSS PR:L), and the installed version must be in the 1.23.0-1.27.0 range. The specific trigger is path traversal injected through the language user configuration parameter, which re-exposes the installer (install.php) to an unprivileged user; from there the attacker invokes installer actions (admin login/creation, or database reconfiguration) and, for code execution, must be able to point FreshRSS at an attacker-controlled MySQL server and set malicious curl_params in the feed table. Limiting factors: no code execution without the attacker-controlled database step; instances that disable self-registration and have no untrusted users are far less exposed, since the attacker needs a usable account; single-user private deployments are low risk despite the network vector.

This is a genuine high-priority issue for internet-exposed instances, not a paper-tiger high-CVSS case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-complexity, network-reachable attack requiring only low privileges - i.e. any registered, unprivileged FreshRSS user - with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). The chain is severe: path traversal in the language parameter re-exposes install.php to a normal user, who can then log in as admin, create new admin accounts, or repoint the database to an attacker MySQL server and achieve code execution via malicious feed curl_params. So effective impact is full application compromise and likely RCE on the host, which is why an independent 3.1 assessment lands higher (~8.8) than the vendor's 7.4; the 4.0 score is tempered by SC:N/SI:N/SA:N (no modeled subsequent-system impact). Exploitation maturity E:P (proof-of-concept) aligns with the input signal that public exploit code exists. No EPSS score and no CISA KEV entry were provided, so there is no evidence of widespread automated exploitation yet - the realistic risk is targeted abuse of multi-user or publicly-registrable instances rather than mass exploitation. The key limiting factor is PR:L: an attacker needs a valid low-privilege account, so single-user or closed-registration deployments face materially lower exposure than instances allowing self-registration.

An attacker holding (or self-registering) an ordinary FreshRSS account on versions 1.23.0-1.27.0 sends a request abusing path traversal in the language configuration parameter to reach install.php, then invokes installer actions to create a new admin user or repoint FreshRSS to an attacker-controlled MySQL server. By injecting malicious feed curl_params into the database, they turn admin takeover into code execution on the host. Public proof-of-concept exploit code exists, and the low attack complexity (AC:L) makes reliable exploitation straightforward once an account is obtained.