What is the CVSS score of CVE-2026-50872?

CVE-2026-50872 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of fossar selfoss are affected by CVE-2026-50872?

fossar selfoss v2.20-SNAPSHOT contains a critical remote code execution vulnerability (CVSS 9.8) enabling unauthenticated attackers to execute arbitrary commands and retrieve sensitive data.

How to fix or mitigate CVE-2026-50872?

Within 24 hours: Identify all instances of fossar selfoss v2.20-SNAPSHOT in production; immediately restrict network access to trusted internal networks only and disable public exposure. Within 7 days: Contact vendor to confirm patch timeline and release date; if unavailable, initiate evaluation of alternative RSS feed aggregation solutions. Within 30 days: Deploy vendor patch immediately upon release or complete migration to alternative solution with active security maintenance.

fossar selfoss CVE-2026-50872

EUVD-2026-36770 CRITICAL

Code Injection (CWE-94)

2026-06-15 mitre

GHSA-gqmg-cfhg-mw2q

Code Injection RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable HTTP endpoint, single crafted request, no authentication or user interaction, code injection yields full confidentiality, integrity and availability impact within the web application's privileges.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:33 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.

AnalysisAI

Remote code execution in fossar selfoss v2.20-SNAPSHOT allows unauthenticated attackers to execute arbitrary commands and retrieve sensitive data by sending a crafted HTTP request to the loopback request handling component. The flaw carries a CVSS 9.8 score and a public gist (likely containing proof-of-concept material) is referenced, though EPSS exploitation probability remains low at 0.19% and the issue is not listed in CISA KEV.

Technical ContextAI

selfoss is an open-source PHP-based RSS reader, multi-purpose live stream, mashup and aggregation web application maintained by the fossar organization. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection) and resides in the loopback request handling component - the internal mechanism selfoss uses to dispatch HTTP requests to itself, typically used for spout (feed source) processing and background tasks. Improper sanitization or validation of attacker-controlled input that flows into a code-execution sink (such as eval, dynamic include, or command shell call) within this loopback path enables an attacker to coerce the server into executing arbitrary code in the application's context.

RemediationAI

No vendor-released patch identified at time of analysis - the EUVD and NVD references do not cite a fixed version or commit. Operators should monitor the fossar/selfoss GitHub repository for a security release that supersedes v2.20-SNAPSHOT and upgrade as soon as one is published. As compensating controls in the interim, restrict network exposure of the selfoss instance by placing it behind an authenticating reverse proxy (HTTP basic auth or SSO) so that anonymous requests cannot reach the loopback endpoint, and firewall the application port to trusted source IPs only; this preserves normal feed-reader use for known users but breaks any public-facing deployment. Consider running selfoss under a low-privilege OS user with no shell, and applying egress filtering from the host so that successful RCE cannot be used to fetch second-stage payloads or exfiltrate data; consult the gist at https://gist.github.com/pyuysig/272bf96c028ed45ad010b7c75937c914 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-50872 for any later-added mitigation guidance.