CVE-2025-59949CWE-352csrf

CVE-2025-59949

Medium · published December 19, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-12-19T00:16Z
Affected products (1)
ProductVersionsFixed in
freshrss/freshrss< 1.27.11.27.1
References (5)
https://github.com/FreshRSS/FreshRSS/pull/7958 · [email protected]https://github.com/FreshRSS/FreshRSS/pull/7997 · [email protected]https://github.com/FreshRSS/FreshRSS/pull/7999 · [email protected]https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 · [email protected]https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 DEC 18:31Z
    FreshRSS has Logout CSRF that Leads to DoS via <track src>
    cvelistv5