TI-2026-17586 CVE-2026-21885 · GHSA-xwh2-742g-w3wp
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
Priority MEDIUM 62
Miniflux 2 is an open source feed reader.
miniflux
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
miniflux records in CISA KEVNo miniflux vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2026-70714 CVE-2026-108735 · GHSA-f5cv-wgfv-h2x2
Server-side request forgery in Miniflux via per-feed proxy URL
Priority MEDIUM 57
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url.
TI-2025-41410 CVE-2025-67713 · GHSA-wqv2-4wpg-8hc9
Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
Priority MEDIUM 57
Miniflux 2 is an open source feed reader.
TI-2026-39867 CVE-2026-55185 · GHSA-m999-j542-5w3r
Miniflux 2: Open Redirect Bypass
Priority MEDIUM 56
Miniflux 2 is an open source feed reader.
TI-2023-12301 CVE-2023-27591 · GHSA-3qjf-qh38-x73v
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Priority MEDIUM 40
Miniflux is a feed reader.
TI-2023-12302 CVE-2023-27592 · GHSA-mqqg-xjhj-wfgw
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Priority LOW 25
Miniflux is a feed reader.
TI-2025-22664 CVE-2025-31483 · GHSA-cq88-842x-2jhp
Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Priority LOW 22
Miniflux is a feed reader.