Vulnerability-Lookup

CVE-2026-21885 (GCVE-0-2026-21885)

Vulnerability from cvelistv5 – Published: 2026-01-08 13:57 – Updated: 2026-01-08 15:55

Title

Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

Summary

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/miniflux/v2/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
miniflux	v2	Affected: < 2.2.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21885",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T14:52:34.949191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T15:55:28.121Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "v2",
          "vendor": "miniflux",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux\u0027s media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-08T13:57:25.445Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp"
        }
      ],
      "source": {
        "advisory": "GHSA-xwh2-742g-w3wp",
        "discovery": "UNKNOWN"
      },
      "title": "Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21885",
    "datePublished": "2026-01-08T13:57:25.445Z",
    "dateReserved": "2026-01-05T17:24:36.928Z",
    "dateUpdated": "2026-01-08T15:55:28.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-21885",
      "date": "2026-06-28",
      "epss": "0.00258",
      "percentile": "0.17062"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-21885\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-08T14:15:57.257\",\"lastModified\":\"2026-06-17T10:19:05.410\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux\u0027s media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Miniflux 2 es un lector de feeds de c\u00f3digo abierto. Antes de la versi\u00f3n 2.2.16, el endpoint de proxy de medios de Miniflux (\u0027GET /proxy/{encodedDigest}/{encodedURL}\u0027) puede ser abusado para realizar Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF). Un usuario autenticado puede hacer que Miniflux genere una URL de proxy firmada para URLs de medios elegidas por el atacante incrustadas en el contenido de la entrada del feed, incluyendo direcciones internas (p. ej., localhost, rangos privados RFC1918 o endpoints de metadatos de enlace local). Solicitar la URL resultante \u0027/proxy/...\u0027 hace que Miniflux obtenga y devuelva la respuesta interna. La versi\u00f3n 2.2.16 corrige el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"miniflux\",\"product\":\"v2\",\"versions\":[{\"version\":\"\u003c 2.2.16\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-08T14:52:34.949191Z\",\"id\":\"CVE-2026-21885\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.2.16\",\"matchCriteriaId\":\"145FED28-3379-45DD-B388-01F5ADF6A766\"}]}]}],\"references\":[{\"url\":\"https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-21885\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-08T14:52:34.949191Z\"}}}], \"references\": [{\"url\": \"https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-08T14:52:37.831Z\"}}], \"cna\": {\"title\": \"Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources\", \"source\": {\"advisory\": \"GHSA-xwh2-742g-w3wp\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"miniflux\", \"product\": \"v2\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.2.16\"}]}], \"references\": [{\"url\": \"https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp\", \"name\": \"https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux\u0027s media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-08T13:57:25.445Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-21885\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-08T15:55:28.121Z\", \"dateReserved\": \"2026-01-05T17:24:36.928Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-08T13:57:25.445Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-21885

Vulnerability from fkie_nvd - Published: 2026-01-08 14:15 - Updated: 2026-06-17 10:19

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	miniflux_project	miniflux	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "v2",
          "vendor": "miniflux",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.16"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:go:*:*",
              "matchCriteriaId": "145FED28-3379-45DD-B388-01F5ADF6A766",
              "versionEndExcluding": "2.2.16",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux\u0027s media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Miniflux 2 es un lector de feeds de c\u00f3digo abierto. Antes de la versi\u00f3n 2.2.16, el endpoint de proxy de medios de Miniflux (\u0027GET /proxy/{encodedDigest}/{encodedURL}\u0027) puede ser abusado para realizar Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF). Un usuario autenticado puede hacer que Miniflux genere una URL de proxy firmada para URLs de medios elegidas por el atacante incrustadas en el contenido de la entrada del feed, incluyendo direcciones internas (p. ej., localhost, rangos privados RFC1918 o endpoints de metadatos de enlace local). Solicitar la URL resultante \u0027/proxy/...\u0027 hace que Miniflux obtenga y devuelva la respuesta interna. La versi\u00f3n 2.2.16 corrige el problema."
    }
  ],
  "id": "CVE-2026-21885",
  "lastModified": "2026-06-17T10:19:05.410",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21885",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-08T14:52:34.949191Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-08T14:15:57.257",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XWH2-742G-W3WP

Vulnerability from github – Published: 2026-01-07 19:22 – Updated: 2026-01-08 21:19

Summary

Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

Details

Summary

Miniflux's media proxy endpoint (GET /proxy/{encodedDigest}/{encodedURL}) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting /proxy/... URL makes Miniflux fetch and return the internal response.

Details

Vulnerable route: GET /proxy/{encodedDigest}/{encodedURL} (accessible without authentication, but requires a server-generated HMAC-signed URL)
Handler: internal/ui/proxy.go ((*handler).mediaProxy)
Trigger: entry content is rewritten to proxy media URLs (e.g., mediaproxy.RewriteDocumentWithAbsoluteProxyURL(...)), producing signed /proxy/... URLs.
Root cause: the proxy validates the URL scheme and HMAC signature, but does not restrict target hosts/IPs. As a result, requests to loopback/private/link-local addresses are allowed and fetched by the server.

PoC

1) Run Miniflux 2.2.15 with default configuration (media proxy enabled by default: MEDIA_PROXY_MODE=http-only).

2) Log in with any normal user account.

3) Subscribe to a feed you control that contains an entry with an image URL pointing to an internal address reachable from the Miniflux server, e.g.: - <img src="http://<internal-target>/secret"> (Note: <internal-target> must be reachable from the Miniflux process/network; in containerized setups, 127.0.0.1 may not refer to the host.)

4) Open the entry and locate the rewritten media proxy URL (/proxy/<encodedDigest>/<encodedURL>) in the rendered HTML/page source.

5) Request the /proxy/... URL. Expected (vulnerable): Miniflux fetches the internal URL and returns the internal response (SSRF).

Impact

Type: SSRF (Server-Side Request Forgery) via media proxy
Who is impacted: Miniflux instances with media proxy enabled (default configuration typically enables it for HTTP/mixed content handling).
Impact: attackers with a valid Miniflux account can fetch internal resources reachable from the Miniflux server (e.g., localhost services, private network services, and link-local endpoints such as 169.254.169.254), potentially exposing sensitive data.

Suggested CVSS (v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Base 6.5)

If there any questions or issues reproducing this, please contact: jeongwoolee340@gmail.com

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.2.15"
      },
      "package": {
        "ecosystem": "Go",
        "name": "miniflux.app/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-07T19:22:14Z",
    "nvd_published_at": "2026-01-08T14:15:57Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nMiniflux\u0027s media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response.\n\n### Details\n- **Vulnerable route**: `GET /proxy/{encodedDigest}/{encodedURL}` (accessible without authentication, but requires a server-generated HMAC-signed URL)\n- **Handler**: `internal/ui/proxy.go` (`(*handler).mediaProxy`)\n- **Trigger**: entry content is rewritten to proxy media URLs (e.g., `mediaproxy.RewriteDocumentWithAbsoluteProxyURL(...)`), producing signed `/proxy/...` URLs.\n- **Root cause**: the proxy validates the URL scheme and HMAC signature, but does not restrict target hosts/IPs. As a result, requests to loopback/private/link-local addresses are allowed and fetched by the server.\n\n### PoC\n1) Run Miniflux 2.2.15 with default configuration (media proxy enabled by default: `MEDIA_PROXY_MODE=http-only`).\n\n2) Log in with any normal user account.\n\n3) Subscribe to a feed you control that contains an entry with an image URL pointing to an internal address reachable from the Miniflux server, e.g.:\n   - `\u003cimg src=\"http://\u003cinternal-target\u003e/secret\"\u003e`\n   (Note: `\u003cinternal-target\u003e` must be reachable *from the Miniflux process/network*; in containerized setups, `127.0.0.1` may not refer to the host.)\n\n4) Open the entry and locate the rewritten media proxy URL (`/proxy/\u003cencodedDigest\u003e/\u003cencodedURL\u003e`) in the rendered HTML/page source.\n\n5) Request the `/proxy/...` URL.\nExpected (vulnerable): Miniflux fetches the internal URL and returns the internal response (SSRF).\n\n### Impact\n**Type**: SSRF (Server-Side Request Forgery) via media proxy  \n**Who is impacted**: Miniflux instances with media proxy enabled (default configuration typically enables it for HTTP/mixed content handling).  \n**Impact**: attackers with a valid Miniflux account can fetch internal resources reachable from the Miniflux server (e.g., localhost services, private network services, and link-local endpoints such as 169.254.169.254), potentially exposing sensitive data.\n\n### Suggested CVSS (v3.1)\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N` (Base 6.5)\n\n\n\n\nIf there any questions or issues reproducing this, please contact: jeongwoolee340@gmail.com",
  "id": "GHSA-xwh2-742g-w3wp",
  "modified": "2026-01-08T21:19:09Z",
  "published": "2026-01-07T19:22:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21885"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/miniflux/v2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-21885 (GCVE-0-2026-21885)

FKIE_CVE-2026-21885

GHSA-XWH2-742G-W3WP

Summary

Details

PoC

Impact

Suggested CVSS (v3.1)

Tags

Sightings

Nomenclature