CVE-2025-58173

CVE-2025-58173 is a unknown severity vulnerability affecting the affected product.

Description: FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it’s possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an […]

Affected Versions:
❌ Vulnerable: 1.23.0 - 1.27.0
✅ Safe: ≥ 1.27.1

Exploit Difficulty: HARD
⏱️ Time to exploit: > 4 hours
🛠️ Required skills: Advanced security expertise
💰 Public exploits: Rare or not public

How to Fix:


- Check if you're running the affected product
- Verify version (vulnerable: 1.23.0 - 1.27.0)


- Update to ≥ 1.27.1 or later
- If patching is not immediately possible: restrict network exposure, apply least-privilege access


- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)


- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations