Skip to content
OpenAdvisories

Package · Debian

miniflux

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 4.3
    CVE-2026-108735

    Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL

    Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_P…

    miniflux miniflux miniflux miniflux Debian Ubuntu
  • Medium 5.1
    CVE-2026-55185

    Miniflux 2: Open Redirect Bypass

    Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward …

    miniflux v2 miniflux.app/v2 miniflux Debian Ubuntu Go
  • Medium 6.5
    CVE-2026-21885

    Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

    Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a …

    miniflux v2 miniflux.app/v2 miniflux.app Debian Ubuntu Go
  • Medium 4.8
    CVE-2025-31483

    Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration

    Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP…

    miniflux v2 miniflux.app/v2 miniflux Debian Ubuntu Go