High · published December 16, 2025
⚡ A sneaky path traversal in FreshRSS lets anyone unlock the admin door without a key! 🚪💥 Think of it as a diner where anyone can slip behind the counter and start mixing the secret sauce, regardless of their status. With a clever tweak in the `language` parameter, any unprivileged user could gain full control over the kitchen operations! 🍔 The consequences could be absolutely devastating — imagine a hacker logging in as the admin, creating new admin accounts, or rerouting your database to their own server. This means they could execute malicious code and control your RSS feeds like a puppet master pulling strings. 🎭
Think of it as a diner where anyone can slip behind the counter and start mixing the secret sauce, regardless of their status. With a clever tweak in the `language` parameter, any unprivileged user could gain full control over the kitchen operations! 🍔 This vulnerability arises from a path traversal flaw in FreshRSS versions 1.23.0 to 1.27.0, allowing attackers to exploit the `language` user configuration parameter to access sensitive files like `install.php` and perform administrative actions without proper authentication.
The consequences could be absolutely devastating — imagine a hacker logging in as the admin, creating new admin accounts, or rerouting your database to their own server. This means they could execute malicious code and control your RSS feeds like a puppet master pulling strings. 🎭 To secure your FreshRSS installation, upgrade immediately to version 1.27.1. Additionally, review your configuration settings to ensure that no unauthorized access is possible. Don't forget to audit your user permissions as an extra safety measure! 🔍✅ You've got this! Follow these steps, and you'll have your FreshRSS locked down tighter than a drum. 🛡️✨
| Product | Versions | Fixed in |
|---|---|---|
| freshrss/freshrss | ≥ 1.23.0, < 1.27.1 | 1.27.1 |