CVE-2025-31482: FreshRSS Feed Aggregator DoS Vulnerability

CVE-2025-31482 Overview

CVE-2025-31482 affects FreshRSS, a self-hosted RSS feed aggregator. Versions prior to 1.26.2 contain a flaw that allows a malicious feed entry to repeatedly log out an authenticated user. The result is a denial of service condition tied to the victim's session. The issue is classified under [CWE-352] Cross-Site Request Forgery and requires user interaction, specifically the fetching of a crafted feed entry. FreshRSS version 1.26.2 contains a patch for the issue.

Critical Impact
Authenticated FreshRSS users can be repeatedly logged out after fetching a malicious feed entry, disrupting normal use of the aggregator until the underlying feed is removed or the instance is patched.

Affected Products

FreshRSS versions prior to 1.26.2
Self-hosted FreshRSS instances subscribed to untrusted feeds
Deployments running the vulnerable freshrss:freshrss component

Discovery Timeline

2025-06-04 - CVE-2025-31482 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31482

Vulnerability Analysis

The vulnerability lives in how FreshRSS processes content from remote feed entries. An attacker who controls or can inject content into a feed the victim subscribes to can craft an entry that triggers an unwanted state-changing action against the victim's session. When the victim fetches or views the malicious entry, the crafted content causes the user's authenticated session to terminate. Repeated exposure to the entry produces a repeatable logout loop that prevents productive use of the application.

The issue is a Cross-Site Request Forgery [CWE-352] weakness. State-changing endpoints, including those governing session termination, do not adequately validate the origin or intent of requests that arise while rendering third-party feed content. Because RSS content is untrusted by design, embedded elements can coerce the browser into issuing authenticated requests to the FreshRSS instance.

Root Cause

The root cause is missing or insufficient CSRF protection on endpoints that terminate a user's session. FreshRSS renders remote feed content within the authenticated user's browser context. Without strict anti-CSRF checks on logout-related actions, feed-borne payloads can trigger those actions using the victim's existing cookies.

Attack Vector

An attacker publishes or injects a crafted entry into a feed consumed by the target. When the target's FreshRSS session loads the entry, the malicious markup or embedded reference triggers a request that logs the user out. Because the entry persists in the feed cache, each subsequent visit re-triggers the logout, producing a sustained denial of service against the account. Exploitation requires user interaction but no privileges on the FreshRSS instance.

No verified proof-of-concept code is published. See the FreshRSS Security Advisory GHSA-vpmc-3fv2-jmgp for vendor-provided technical details.

Detection Methods for CVE-2025-31482

Indicators of Compromise

Repeated, unexplained session terminations for FreshRSS users shortly after fetching new feed content.
Web server access logs showing back-to-back authentication events followed by logout requests from the same client.
Feed entries containing unexpected HTML elements or references that target FreshRSS logout or session endpoints.

Detection Strategies

Correlate FreshRSS application logs with reverse-proxy logs to identify logout requests that originate from rendered feed content rather than user-initiated UI actions.
Inspect cached feed entries for embedded links or markup pointing to internal FreshRSS routes.
Track the FreshRSS version reported by deployed instances and flag any running a release earlier than 1.26.2.

Monitoring Recommendations

Alert on abnormal spikes in per-user logout events within short time windows.
Monitor outbound HTTP requests fetching feeds from newly added or low-reputation sources.
Review user support tickets referencing repeated forced logouts to identify affected accounts quickly.

How to Mitigate CVE-2025-31482

Immediate Actions Required

Upgrade all FreshRSS instances to version 1.26.2 or later, which contains the official patch.
Audit subscribed feeds and remove entries or sources associated with reported logout loops.
Communicate the issue to end users and instruct them to report repeated forced logouts.

Patch Information

FreshRSS 1.26.2 remediates CVE-2025-31482. Administrators should update container images, package installs, or Git-based deployments to 1.26.2 or later. Refer to the FreshRSS Security Advisory GHSA-vpmc-3fv2-jmgp for full patch notes and upgrade guidance.

Workarounds

If immediate upgrade is not possible, restrict feed subscriptions to trusted publishers only.
Temporarily disable or unsubscribe from feeds implicated in repeated logout events.
Place FreshRSS behind a reverse proxy that enforces strict Referer and Origin checks on logout endpoints.

bash

# Configuration example: upgrade FreshRSS via Docker Compose
docker compose pull freshrss
docker compose up -d freshrss
docker exec freshrss php ./cli/list-users.php