CVE-2025-46339: FreshRSS Feed Favicon Poisoning Vulnerability

CVE-2025-46339 Overview

FreshRSS, a self-hosted RSS feed aggregator, contains a favicon poisoning vulnerability in versions prior to 1.26.2. The flaw allows an authenticated user to replace feed favicons globally for all users of the instance. The favicon hash is derived from the feed URL and salt only, excluding the proxy address, proxy protocol, and SSL verification setting. An attacker can add a feed using an attacker-controlled proxy with SSL verification disabled, intercept the response, and substitute a malicious website URL whose favicon they control. The issue is tracked as [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data].

Critical Impact
Any authenticated FreshRSS user can poison feed favicons visible to all users on the instance, enabling visual spoofing and potential phishing or brand impersonation attacks.

Affected Products

FreshRSS versions prior to 1.26.2
Self-hosted FreshRSS instances using proxy-enabled feed fetching
Multi-user FreshRSS deployments where favicons are shared across accounts

Discovery Timeline

2025-06-04 - CVE-2025-46339 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46339

Vulnerability Analysis

FreshRSS computes a favicon identifier by hashing the feed URL together with a salt value. This hash determines where the favicon is cached and which favicon is displayed to users. The hash input omits three security-relevant feed parameters: the proxy address, the proxy protocol, and the SSL verification flag.

Because these parameters are excluded, two feeds with identical URLs but different fetch configurations produce the same favicon hash. An attacker who routes favicon retrieval through a proxy they control can serve arbitrary image content that will be cached under the hash of the legitimate feed URL. The poisoned favicon is then served to every user viewing that feed.

Root Cause

The root cause is incomplete input coverage in the favicon hashing routine within app/Models/Feed.php. Only trusted inputs (feed URL, salt) participated in the hash computation, while untrusted, user-controlled fetch parameters were ignored. This violates the trust boundary expected by downstream consumers of the hash, which assume the cached favicon reflects content retrieved from the canonical feed source.

Attack Vector

Exploitation requires an authenticated account on the target FreshRSS instance. The attacker adds a feed pointing at the URL of a feed they wish to poison, configures the feed to use a proxy they control, and disables SSL verification. The attacker's proxy intercepts the favicon lookup and returns a response that redirects favicon resolution to a domain hosting an attacker-chosen image. FreshRSS stores the resulting favicon under the hash of the original feed URL, overwriting the entry seen by all other users.

php

// Patch excerpt — app/Models/Feed.php
// Source: https://github.com/FreshRSS/FreshRSS/commit/3776e1e48f33e80eb4b674bb64b419caf3b5a4e2
 	private int $ttl = self::TTL_DEFAULT;
 	private bool $mute = false;
 	private string $hash = '';
+	private string $hashFavicon = '';
 	private string $lockPath = '';
 	private string $hubUrl = '';
 	private string $selfUrl = '';

The fix introduces a dedicated $hashFavicon property, separating favicon identity from the generic feed hash so that proxy and SSL settings can be incorporated into favicon identity calculation.

Detection Methods for CVE-2025-46339

Indicators of Compromise

Feed entries configured with a custom proxy address combined with SSL verification disabled.
Favicon files in the FreshRSS data directory whose content does not match the favicon served by the canonical feed domain.
Audit log entries showing feed creation or modification by low-privilege accounts targeting popular shared feeds.

Detection Strategies

Inspect the FreshRSS feed configuration table for records where proxy is set and ssl_verify is false, and correlate with recent favicon cache changes.
Compare cached favicon hashes against favicons fetched directly from the feed's origin domain over a trusted network path.
Monitor outbound connections from the FreshRSS host to unexpected proxy endpoints that do not match administrator-approved egress destinations.

Monitoring Recommendations

Log and review all feed create and update operations, including the proxy and SSL verification parameters supplied by each user.
Alert on unprivileged users modifying feeds that are subscribed to by multiple accounts on multi-user instances.
Track favicon file modification times under the FreshRSS data path and flag unexpected churn.

How to Mitigate CVE-2025-46339

Immediate Actions Required

Upgrade FreshRSS to version 1.26.2 or later, which incorporates the fix from commit 3776e1e48f33e80eb4b674bb64b419caf3b5a4e2.
Audit existing feeds for entries using custom proxies with SSL verification disabled and remove or re-validate them.
Purge the favicon cache after upgrading so that poisoned images are refetched from canonical sources.

Patch Information

The vendor fix is published in the FreshRSS repository. See the GitHub Security Advisory GHSA-8f79-3q3w-43c4 and the upstream commit that introduces a dedicated favicon hash incorporating proxy and SSL verification settings.

Workarounds

Restrict feed creation to trusted administrator accounts until the upgrade is applied.
Disable the use of per-feed proxy configuration at the application or reverse proxy layer where feasible.
Enforce SSL verification globally for outbound feed fetches by overriding the per-feed setting in deployment configuration.

bash

# Verify the installed FreshRSS version meets the fixed release
grep -R "FRESHRSS_VERSION" /var/www/FreshRSS/constants.php

# Clear the favicon cache after upgrading
rm -f /var/www/FreshRSS/data/favicons/*.ico