CVE-2025-31134CWE-201

FreshRSS vulnerable to directory enumeration via ext.php

Medium · published June 4, 2025

CVSS v4.0
5.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2025-06-04T19:35Z
EPSS history
Timeline
  • 04 JUN 19:35Z
    FreshRSS vulnerable to directory enumeration via ext.php
    cvelistv5