« Volver al listado

CVE-2026-21885

Estado: AnalizadaMedia (6.5)—

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Miniflux Project — Miniflux

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-21885",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21885",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-08T14:52:34.949191Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "miniflux",
          "product": "v2",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.2.16"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-08T14:15:57.257",
  "references": [
    {
      "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Miniflux 2 es un lector de feeds de código abierto. Antes de la versión 2.2.16, el endpoint de proxy de medios de Miniflux ('GET /proxy/{encodedDigest}/{encodedURL}') puede ser abusado para realizar Falsificación de Petición del Lado del Servidor (SSRF). Un usuario autenticado puede hacer que Miniflux genere una URL de proxy firmada para URLs de medios elegidas por el atacante incrustadas en el contenido de la entrada del feed, incluyendo direcciones internas (p. ej., localhost, rangos privados RFC1918 o endpoints de metadatos de enlace local). Solicitar la URL resultante '/proxy/...' hace que Miniflux obtenga y devuelva la respuesta interna. La versión 2.2.16 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:19:05.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "145FED28-3379-45DD-B388-01F5ADF6A766",
              "versionEndExcluding": "2.2.16",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}