Description
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| miniflux | miniflux | 2.3.0 – ≤ 2.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | miniflux | 2.3.4-1 | — |
| Debian 13 | miniflux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | miniflux | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | miniflux | No fix yet | — |
| Ubuntu Pro 24.04 LTS | miniflux | No fix yet | — |
References
- https://hackmd.io/@haind03/miniflux-feed-proxy-url-private-network-bypass third-party-advisory
- https://github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/reader/fetcher/request_builder.go#L155-L220 technical-description
- https://github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/urllib/url.go#L64-L72 technical-description
- https://github.com/miniflux/v2 product
- VulnCheck Advisory: Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL third-party-advisory