CVE-2026-21885CWE-918

Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

Medium · published January 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-01-08T13:57Z
EPSS history
Timeline
  • 08 JAN 13:57Z
    Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
    cvelistv5