CVE-2025-54593: 
NixOS vulnerability analysis and mitigation

CVE-2025-54593 is an authenticated remote code execution (RCE) vulnerability in FreshRSS, a free self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator can modify the application's update URL to point to an attacker-controlled server, then trigger an update to execute arbitrary code on the FreshRSS server. The vulnerability was published on August 1, 2025, and patched in version 1.26.2. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper control of code generation (CWE-94): FreshRSS allowed administrators to configure the auto_update_url setting via the system configuration interface, and the update mechanism would fetch and execute content from that URL without sufficient validation. FreshRSS checks for updates by querying a URL (e.g., https://update.freshrss.org/?v=<version>) and parsing the response to determine whether an update package should be downloaded and applied. An attacker with admin credentials could replace this URL with one they control, serve a malicious update payload, and trigger code execution by initiating an update. The fix, implemented in PR #7477, makes the auto_update_url property read-only in SystemConfiguration.php and removes the corresponding input field from the admin UI, preventing runtime modification of the update URL (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated administrator to achieve arbitrary code execution on the underlying server, with the privileges of the web server process. Post-exploitation consequences include exfiltration of user data (including hashed passwords), defacement of the FreshRSS instance when file permissions permit, and insertion of malicious code to capture plaintext passwords at login time. The scope is limited to the affected FreshRSS instance, but lateral movement within the hosting environment is possible depending on server configuration (GitHub Advisory).

Exploitation requires authenticated administrator access, which limits the attack surface compared to unauthenticated vulnerabilities. No public exploit code or weaponized toolkits have been identified beyond the security advisory itself. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.103%, reflecting low near-term exploitation probability (GitHub Advisory, Feedly).

1. Gain administrator access: Authenticate to the FreshRSS instance as an administrator, either through compromised credentials, credential reuse, or social engineering.
2. Navigate to system configuration: Access the administration panel and locate the system/update configuration settings where the auto_update_url field is exposed (only in versions < 1.26.2).
3. Set up a malicious update server: Host an attacker-controlled HTTP server that responds to update check requests (e.g., /?v=<version>) with an UPDATE <version> response followed by a malicious update package.
4. Modify the update URL: Change the auto_update_url setting in FreshRSS to point to the attacker-controlled server.
5. Trigger the update process: Initiate an update check or update action from the FreshRSS admin interface, causing the server to fetch and execute the malicious payload from the attacker-controlled URL.
6. Achieve code execution: The malicious update package is processed by FreshRSS, resulting in arbitrary code execution under the web server's process privileges, enabling data exfiltration, backdoor installation, or further lateral movement (GitHub Advisory, Patch Commit).

• Logs: FreshRSS or web server access logs showing HTTP requests to an unexpected or external update URL (not update.freshrss.org) from the FreshRSS server process; admin activity logs showing modification of the auto_update_url configuration setting.
• Network: Outbound HTTP/HTTPS connections from the FreshRSS server to unfamiliar or attacker-controlled domains during update checks; unexpected file downloads initiated by the web server process.
• File System: Unexpected or newly created PHP files in the FreshRSS installation directory; modifications to core FreshRSS files with recent timestamps inconsistent with legitimate updates; presence of web shells or backdoor scripts.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, curl, wget, python) following an update action; unexpected cron jobs or scheduled tasks created under the web server account (GitHub Advisory).

FreshRSS has released version 1.26.2 (and subsequently 1.26.3) which fixes this vulnerability by making the auto_update_url configuration property read-only, preventing administrators from modifying it through the UI or API. All users running FreshRSS 1.26.1 or earlier should upgrade to version 1.26.2 or later immediately. As a temporary workaround for those unable to upgrade, restricting administrator account access and disabling the auto-update feature can reduce risk (GitHub Release, Patch Commit).

The vulnerability was disclosed by FreshRSS maintainer Alkarex via a GitHub Security Advisory on July 31, 2025, crediting researcher @Inverle for the discovery. The fix was noted as part of a broader security-focused release (1.26.2) addressing multiple CVEs. The release received positive community engagement on GitHub, with 28 reactions. No significant broader media coverage or notable external researcher commentary has been identified (GitHub Advisory, GitHub Release).