Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration

MEDIO 4.8CVE-2025-31483 · GHSA-cq88-842x-2jhp · GO-2025-3591 · Published 03/04/2025 · updated 17/06/2026

In breve

CVE-2025-31483 è una vulnerabilità MEDIO (CVSS 4.8) che riguarda miniflux.app, miniflux.app/v2.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.43%, superiore al 37.0% delle vulnerabilità.
Correzione: aggiornare a 2.2.7 o successiva.

Package	Affected versions	Patched versions
miniflux.app Go	`all versions`	No fix yet
miniflux.app/v2 Go	`< 2.2.7`	`2.2.7`

Description

Summary

Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window.

Impact

A malicious feed added to Miniflux can execute arbitrary JavaScript in the user's browser when opening external resources, such as proxified images, in a new tab or window.

Mitigation

The CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;.

Upgrade to Miniflux >= 2.2.7

Credit

RyotaK (GMO Flatt Security Inc.) with takumi-san.ai

NVD description

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.

References

miniflux/v2 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-31483 · ADVISORY
miniflux/v2 commit cb695e6 · WEB
miniflux/v2 · PACKAGE

Altre vulnerabilità di miniflux.app

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

miniflux.app

all versions

No fix yet

miniflux.app/v2

< 2.2.7

2.2.7