CVE-2026-50872 Overview
CVE-2026-50872 is a code injection vulnerability [CWE-94] affecting the loopback request handling component of fossar selfoss v2.20-SNAPSHOT. The flaw allows unauthenticated remote attackers to execute arbitrary commands and access sensitive information by sending a crafted HTTP request to the application. Selfoss is an open-source web-based RSS reader and multi-source feed aggregator, making exposed instances reachable over the network a direct target. The vulnerability requires no privileges and no user interaction, raising the risk of broad opportunistic exploitation against internet-facing deployments.
Critical Impact
Unauthenticated attackers can execute arbitrary commands on hosts running selfoss v2.20-SNAPSHOT and exfiltrate sensitive data via a crafted HTTP request.
Affected Products
- fossar selfoss v2.20-SNAPSHOT
- Selfoss loopback request handling component
- Deployments exposing selfoss endpoints over HTTP/HTTPS
Discovery Timeline
- 2026-06-15 - CVE-2026-50872 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
- 2026-06-18 - EPSS score recorded at 0.56% (42.158 percentile)
Technical Details for CVE-2026-50872
Vulnerability Analysis
The vulnerability resides in how selfoss processes loopback HTTP requests routed internally between application components. Insufficient validation of request data allows attacker-controlled input to be interpreted as code or shell commands rather than as inert data. Because selfoss is a network-facing PHP application, an unauthenticated remote attacker can reach the vulnerable handler directly. Successful exploitation yields arbitrary command execution in the context of the web server process, along with disclosure of application secrets, configuration, and stored feed credentials.
Root Cause
The root cause is improper control of generation of code [CWE-94] in the loopback request handler. Untrusted HTTP input flows into a code or command execution sink without sufficient sanitization, type enforcement, or allow-listing. This design weakness collapses the trust boundary between externally supplied parameters and internal request dispatch logic.
Attack Vector
The attack vector is network based and requires neither authentication nor user interaction. An attacker crafts an HTTP request targeting the loopback request handling endpoint of an exposed selfoss instance. The malicious payload is processed by the vulnerable component, where injected instructions are executed by the underlying interpreter. The full proof-of-concept is published as a GitHub Gist PoC, demonstrating the request structure required to trigger command execution.
Detection Methods for CVE-2026-50872
Indicators of Compromise
- Unexpected HTTP requests targeting selfoss loopback or internal dispatch endpoints from external sources.
- Web server processes (php-fpm, apache2, nginx workers) spawning shell utilities such as sh, bash, curl, or wget.
- Outbound network connections from the selfoss host to unfamiliar IP addresses immediately following HTTP POST activity.
- New or modified files within the selfoss web root, particularly in writable cache or data directories.
Detection Strategies
- Inspect web server access logs for crafted parameters and abnormal payloads sent to selfoss request handlers.
- Correlate process creation events on the selfoss host with parent processes belonging to the web server.
- Apply behavioral identification rules for web shell activity, including reverse shells and reconnaissance commands like id, uname, and whoami.
Monitoring Recommendations
- Forward web server, PHP, and host process telemetry to a centralized analytics platform for cross-source correlation.
- Alert on first-time outbound connections from the selfoss host process to external destinations.
- Track file integrity within the selfoss installation directory and feed credential storage.
How to Mitigate CVE-2026-50872
Immediate Actions Required
- Restrict network exposure of selfoss instances by placing them behind authenticated reverse proxies or VPN-only access.
- Audit selfoss hosts for signs of prior exploitation, including web shells, unauthorized cron entries, and modified PHP files.
- Rotate credentials stored in selfoss configuration, including feed account passwords and database credentials.
Patch Information
No vendor advisory or fixed version is referenced in the published CVE data at the time of writing. Administrators should monitor the fossar/selfoss GitHub repository for an upstream fix and upgrade away from the v2.20-SNAPSHOT development build to a stable, patched release once available.
Workarounds
- Block external access to the loopback request handling endpoint at the web server or WAF layer until a patched build is deployed.
- Run selfoss as a low-privilege user inside a hardened container with no outbound internet access except to required feed sources.
- Enforce strict PHP disable_functions settings to limit command execution primitives such as exec, system, passthru, and shell_exec.
- Apply WAF signatures to drop requests containing shell metacharacters or PHP code fragments directed at selfoss endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
