EUVD-2026-36770
GHSA-gqmg-cfhg-mw2q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed selfoss instance
-
DeliveryCraft malicious HTTP request
-
ExploitSubmit to loopback handler
-
ExecutionTrigger code injection sink
-
PersistExecute arbitrary command as web user
-
ImpactExfiltrate configuration and credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be running fossar selfoss v2.20-SNAPSHOT with the loopback request handling component reachable from the attacker - typically a default installation whose HTTP interface is exposed to the network without an upstream authenticating proxy. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, and exploitation is achieved by a single crafted HTTP request. Limiting factors are practical rather than technical: instances deployed only on internal LAN segments, fronted by HTTP basic auth or SSO, or restricted by IP allow-listing are not reachable for opportunistic exploitation, and operators on stable tagged releases (rather than the named SNAPSHOT development build) may or may not be affected depending on a maintainer's clarification. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated, low-complexity flaw with full CIA impact - the worst-case profile. However, the EPSS score of 0.19% (9th percentile) and absence from the CISA KEV catalog indicate that broad opportunistic exploitation is not currently observed. The lone reference is a GitHub gist that likely contains technical details or PoC code, raising the practical exploitation likelihood beyond what EPSS alone suggests. CPE data is uninformative ('n/a:n/a'), so affected version coverage in NVD scanners may be incomplete - defenders relying on automated CPE matching could miss this CVE, and the only authoritative version anchor is 'v2.20-SNAPSHOT' from the description, which is a development build identifier rather than a tagged release. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed selfoss v2.20-SNAPSHOT instance via Shodan or similar reconnaissance and sends a crafted HTTP request targeting the loopback request handling endpoint, injecting payload data that is reflected into a code-execution sink. The server executes the attacker's command as the web application user, allowing retrieval of configuration files (including database credentials and feed source secrets) and establishment of a reverse shell. Publicly available exploit code exists in a referenced gist, lowering the skill barrier for opportunistic exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote code execution in fossar selfoss v2.20-SNAPSHOT allows unauthenticated attackers to execute arbitrary commands and retrieve sensitive data by sending a crafted HTTP request to the loopback request handling component. The flaw carries a CVSS 9.8 score and a public gist (likely containing proof-of-concept material) is referenced, though EPSS exploitation probability remains low at 0.19% and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the EUVD and NVD references do not cite a fixed version or commit. Operators should monitor the fossar/selfoss GitHub repository for a security release that supersedes v2.20-SNAPSHOT and upgrade as soon as one is published. As compensating controls in the interim, restrict network exposure of the selfoss instance by placing it behind an authenticating reverse proxy (HTTP basic auth or SSO) so that anonymous requests cannot reach the loopback endpoint, and firewall the application port to trusted source IPs only; this preserves normal feed-reader use for known users but breaks any public-facing deployment. Consider running selfoss under a low-privilege OS user with no shell, and applying egress filtering from the host so that successful RCE cannot be used to fetch second-stage payloads or exfiltrate data; consult the gist at https://gist.github.com/pyuysig/272bf96c028ed45ad010b7c75937c914 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-50872 for any later-added mitigation guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
selfoss is an open-source PHP-based RSS reader, multi-purpose live stream, mashup and aggregation web application maintained by the fossar organization. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection) and resides in the loopback request handling component - the internal mechanism selfoss uses to dispatch HTTP requests to itself, typically used for spout (feed source) processing and background tasks. Improper sanitization or validation of attacker-controlled input that flows into a code-execution sink (such as eval, dynamic include, or command shell call) within this loopback path enables an attacker to coerce the server into executing arbitrary code in the application's context.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP endpoint, single crafted request, no authentication or user interaction, code injection yields full confidentiality, integrity and availability impact within the web application's privileges.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.
Executive ViewAI
fossar selfoss v2.20-SNAPSHOT contains a critical remote code execution vulnerability (CVSS 9.8) enabling unauthenticated attackers to execute arbitrary commands and retrieve sensitive data. Any organization running this RSS feed reader faces immediate risk of complete system compromise and data exfiltration. Urgent containment and vendor patching assessment required.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict network-level access controls limiting selfoss to internal networks only with firewall rules blocking external requests; (2) Deploy Web Application Firewall rules targeting the loopback request handling component to filter malicious HTTP requests; (3) Run application in restricted containers with minimal process privileges and read-only filesystem where possible; (4) Enable comprehensive logging and alerting on process execution and network connections for anomaly detection; (5) Maintain offline backups of all critical RSS feed data and application configurations; (6) Identify and stage alternative RSS aggregation solution for rapid migration if exploitation occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB