CVE-2025-31134
📋 TL;DR
FreshRSS versions before 1.26.2 contain an information disclosure vulnerability that allows attackers to check for the existence of specific directories on the server. This can reveal details about installed software (like older PHP versions) and potentially enable further attacks. All self-hosted FreshRSS instances running vulnerable versions are affected.
💻 Affected Systems
- FreshRSS
📦 What is this software?
Freshrss by Freshrss
⚠️ Risk & Real-World Impact
Worst Case
Attackers gather detailed server information, identify vulnerable software versions, and chain this with other exploits to gain unauthorized access or execute arbitrary code.
Likely Case
Attackers discover installed software versions and use that information to target known vulnerabilities in those components, potentially escalating to more severe attacks.
If Mitigated
Limited information disclosure with no direct path to compromise if proper network segmentation and security controls are implemented.
🎯 Exploit Status
Exploitation involves simple directory existence checks; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.26.2
Vendor Advisory: https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65
Restart Required: No
Instructions:
1. Backup your FreshRSS installation and database. 2. Download FreshRSS 1.26.2 or later from the official repository. 3. Replace the existing installation files with the new version. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict Directory Access
allConfigure web server (Apache/Nginx) to deny access to sensitive directories.
# Apache: Add to .htaccess
Deny from all
# Nginx: Add to server block
location ~ /\. { deny all; }
🧯 If You Can't Patch
- Implement strict network access controls to limit FreshRSS exposure to trusted networks only.
- Deploy a web application firewall (WAF) to block directory enumeration attempts.
🔍 How to Verify
Check if Vulnerable:
Check FreshRSS version in the web interface under 'About' or examine the version in the installation directory.Check Version:
grep -r "define('FRESHRSS_VERSION'" /path/to/freshrss/Verify Fix Applied:
Confirm version is 1.26.2 or later and test that directory existence checks no longer return information.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to non-standard directories
- Multiple 403/404 errors for directory paths in short time
Network Indicators:
- HTTP requests probing for directories like /php/, /admin/, or software-specific paths
SIEM Query:
source="web_server" AND (status=403 OR status=404) AND uri CONTAINS "/."