IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-04-03 18:15

MODIFIED

2025-04-07 14:18

EPSS (Prob. Exploit)

0.42%

Top 65.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-cq88-842x-2jhp MODERATE

Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration

AFFECTED PACKAGES:

GO / miniflux.app/v2

< 2.2.7

Fixed in: 2.2.7

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration

AFFECTED PACKAGES:

Unknown / Unknown

75 versions affected

ALIASES:

GHSA-cq88-842x-2jhp, GO-2025-3591

> HISTORIQUE DES MODIFICATIONS

Première apparition

03/04/2025 18:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:02

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui