CVE-2025-58173: 
NixOS vulnerability analysis and mitigation

CVE-2025-58173 is an authenticated remote code execution (RCE) vulnerability in FreshRSS, a self-hosted RSS feed aggregator, caused by a path traversal flaw in the language user configuration parameter. It affects FreshRSS versions 1.23.0 through 1.27.0 and was disclosed on December 15, 2025. The vulnerability allows a low-privileged authenticated user to invoke install.php and perform administrative actions including privilege escalation, rogue admin account creation, and arbitrary code execution. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper input validation (CWE-20) combined with a path traversal weakness (CWE-22) in the language parameter of the user display configuration. When a user sets their language to ../, FreshRSS resolves translation file paths relative to app/i18n/, allowing the traversal to reach app/install.php. The vulnerability chain requires three conditions to align: (1) the path traversal sets the language to ../; (2) a POST request to ?c=auth&a=formLogin with an empty session nonce triggers _t('install.session.nok'), which includes install.php; and (3) the attacker supplies a valid CSRF token. The reachable _t('install.session.nok') call was introduced in v1.23.0 (commit 79604aa), while the language validation removal occurred in v1.22.0 (commit dbbae15), and unsafe curl_params handling dates to v1.18.0 (commit ee175dd) (GitHub Advisory).

Successful exploitation results in full compromise of the FreshRSS instance. An attacker can escalate their session to the default admin user, create a new admin account, or redirect the application's database connection to an attacker-controlled MySQL server. By inserting malicious curl_params (specifically CURLOPT_COOKIEFILE pointing to a PHP config file) into the attacker-controlled database's feed table, the attacker can achieve arbitrary code execution on the server, enabling data exfiltration, persistent access, and potential lateral movement within the hosting environment (GitHub Advisory).

A public proof-of-concept exploit script (exploit.sh) was published alongside the security advisory, demonstrating all three attack paths: session hijacking as admin, privilege escalation, and full RCE via a malicious MySQL server (GitHub Advisory). The CVSS v4.0 vector includes E:P (Proof of Concept exploit maturity). The EPSS score is approximately 0.107%, indicating a currently low but non-negligible probability of exploitation in the wild. No threat actor attribution or CISA KEV catalog listing has been reported at this time. Exploitation requires a low-privileged account and user registration to be enabled (or existing credentials), but no other special configuration.

1. Obtain a low-privileged account: Register a new user account on the target FreshRSS instance (requires user registration to be enabled), or use existing credentials with unsafe login enabled.
2. Authenticate and extract CSRF token: Log in and retrieve the CSRF token from the FreshRSS homepage response (e.g., grep -oP '"csrf":"\K[^"]*').
3. Set language to path traversal payload: Send a POST request to ?c=configure&a=display with the parameter language=../ and the valid CSRF token, causing FreshRSS to resolve translation paths outside the app/i18n/ directory.
4. Trigger install.php inclusion: Send a POST request to ?c=auth&a=formLogin without a valid session nonce. Because the nonce is empty, authController.php calls _t('install.session.nok'), which — with the traversed language path — includes app/install.php.
5. Perform privilege escalation or admin account creation: Use install.php step 1 to switch the session to the default admin user, or step 3 to create a new admin account with a known password.
6. For RCE — redirect database to attacker-controlled MySQL: Use install.php step 2 (POST with database parameters) to overwrite data/config.php pointing to an attacker-controlled MariaDB/MySQL server.
7. Inject malicious curl_params into the feed table: On the attacker-controlled database, insert a feed row with curl_params containing {"10082":"/var/www/FreshRSS/data/users/<username>/config.php"} (CURLOPT_COOKIEFILE), and configure the feed URL to return a crafted HTTP response with a PHP payload.
8. Trigger feed update to execute code: Request ?c=feed&a=actualize&id=1 using a pre-established session, causing FreshRSS to fetch the malicious feed URL and process the injected curl parameters, resulting in arbitrary code execution and a reverse shell (GitHub Advisory).

• Logs: Presence of POST requests to ?c=auth&a=formLogin or ?c=auth&a=formLogin&step=1/3 in web server access logs — these endpoints are not normally called by FreshRSS clients.
• Logs: FreshRSS application log entries containing Invalid session during login for user=, nonce=, gen is not a valid top level key, or PHP fatal errors referencing app/i18n/..//install.php.
• Logs: PHP warning: session_set_cookie_params(): Session cookies cannot be used when session.use_cookies is disabled in the web server error log.
• File System: User config.php files under data/users/*/config.php containing a language value that includes /, \, or . (e.g., 'language' => '../'). Detectable with: grep -irn --include='config.php' -P "(?=.*language' => ')(?=.*[\/\\.])" data/users
• File System: Modified or unexpected data/config.php with an unrecognized default_user value (e.g., _) or external database host.
• Network: Outbound connections from the FreshRSS server to unexpected external MySQL/MariaDB hosts on port 3306, or HTTP connections to attacker-controlled servers on ports 9001/9002.
• Process: Unexpected child processes spawned by the PHP/web server process (e.g., reverse shell connections via bash, nc, curl) (GitHub Advisory).

Upgrade FreshRSS to version 1.27.1, which addresses the vulnerability through three separate patches: PR #7878 disallows setting non-existent language values (preventing the path traversal), PR #7971 makes install.php invocation safer by checking session state, and PR #7979 restricts allowed curl_params to prevent abuse via attacker-controlled databases (GitHub PR #7878, GitHub PR #7971, GitHub PR #7979). As an interim workaround, disabling user self-registration reduces the attack surface by requiring an attacker to already possess valid credentials. Administrators should also audit data/users/*/config.php files for suspicious language values and review data/config.php for unexpected database host entries (GitHub Advisory).

The vulnerability was discovered and reported by security researcher Inverle, who also authored the three remediation pull requests and provided a detailed public PoC exploit script in the GitHub Security Advisory. The advisory was published by FreshRSS maintainer Alkarex on December 15, 2025, and rated Critical severity by the project. A technical write-up was published by Infinitsec covering the authenticated RCE chain (Infinitsec Blog). Red Hat also tracked the CVE in their security database (Red Hat CVE).