What is the CVSS score of CVE-2026-21885?

CVE-2026-21885 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Miniflux are affected by CVE-2026-21885?

Organizations using Miniflux 2 should be aware of notable risk from CVE-2026-21885, a server-side request forgery vulnerability rated CVSS 6.5.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21885?

Yes, a public proof-of-concept exploit is available for CVE-2026-21885. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21885?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Miniflux CVE-2026-21885

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-01-08 security-advisories@github.com

GHSA-xwh2-742g-w3wp

SSRF Miniflux Suse Miniflux Project

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 12, 2026 - 16:55 vuln.today

Public exploit code

CVE Published

Jan 08, 2026 - 14:15 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (GET /proxy/{encodedDigest}/{encodedURL}) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting /proxy/... URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

AnalysisAI

Miniflux's media proxy endpoint is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.16, allowing authenticated users to craft malicious proxy URLs that force the application to fetch and expose responses from internal network resources including localhost and private IP ranges. An attacker with valid credentials can abuse this to access sensitive internal services and metadata endpoints by embedding specially crafted URLs in feed content. Public exploit code exists for this vulnerability, and no patch is currently available for affected installations.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Miniflux. Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (GET /proxy/{encodedDigest}/{encodedURL}) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting /proxy/... URL makes Miniflu