CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2026-21885
Medium (6.5) in miniflux project miniflux. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in miniflux.app/v2 2.2.16.
Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- miniflux_project:miniflux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xwh2-742g-w3wp | Go | miniflux.app/v2 | <2.2.16 | 2.2.16 |
| GO-2026-4287 | Go | miniflux.app | all versions | no fix published |
| GO-2026-4287 | Go | miniflux.app/v2 | <2.2.16 | 2.2.16 |