Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration

Mô tả

Tham khảo

• miniflux/v2 security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-31483 · ADVISORY
• miniflux/v2 commit cb695e6 · WEB
• miniflux/v2 · PACKAGE

Lỗ hổng khác của miniflux.app

• CVE-2026-55185TRUNG BÌNH 5.1Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backs…
• CVE-2026-21885TRUNG BÌNH 6.5Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}…
• CVE-2025-67713TRUNG BÌNH 6.1Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enablin…
• CVE-2023-27591CAO 7.5Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Minifl…