CVSS 4.0
4.8 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NCVE-2025-31483
Medium (4.8). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in miniflux.app/v2 2.2.7.
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cq88-842x-2jhp | Go | miniflux.app/v2 | <2.2.7 | 2.2.7 |
| GO-2025-3591 | Go | miniflux.app | all versions | no fix published |
| GO-2025-3591 | Go | miniflux.app/v2 | <2.2.7 | 2.2.7 |