CVE-2025-59949: 
NixOS vulnerability analysis and mitigation

CVE-2025-59949 is a Cross-Site Request Forgery (CSRF) vulnerability in FreshRSS, a free self-hostable RSS aggregator, that allows attackers to force logout of authenticated users, resulting in a denial of service (DoS) condition. The vulnerability is exploitable via malicious <track src> elements embedded in RSS feed content. All FreshRSS versions prior to 1.27.1 are affected. It was disclosed on December 18, 2025, and carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, or 5.3 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is CWE-352 (Cross-Site Request Forgery): FreshRSS fails to adequately verify the origin of requests to sensitive endpoints. Specifically, two logout CSRF vectors exist: (1) http://freshrss.local/i/?c=auth&a=login&u=x — when a non-empty u parameter is supplied, FreshRSS_Context::initUser() is called with an arbitrary username, causing a session mismatch that logs out the current user; (2) http://freshrss.local/i/?c=javascript&a=nonce&u=x — the javascriptController similarly calls FreshRSS_Context::initUser($user), which changes the session's current user via Minz_User::change(), ultimately invalidating the session. An attacker can trigger these requests automatically by embedding the logout URL as the src attribute of a <track> HTML element inside a malicious RSS feed item, which the browser fetches on page load without user interaction (GitHub Advisory, PR #7997, PR #7999).

Successful exploitation causes authenticated FreshRSS users to be involuntarily logged out whenever they view a feed article containing the malicious <track src> element, resulting in a denial of service against the availability of the RSS aggregator service. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data. The attack affects any user who views a compromised feed, and repeated exploitation can persistently prevent users from maintaining authenticated sessions (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating a malicious RSS feed XML file that embeds the logout URL as a <track src> attribute. Exploitation requires knowing the full URL of the target FreshRSS instance (which could be leaked via older versions). There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify the full URL of the target FreshRSS instance. On older FreshRSS versions (<1.27.0), the instance URL may be leaked through feed metadata or other side channels.
2. Craft malicious RSS feed: Create an RSS/Atom feed XML file containing an article with an HTML <track> element whose src attribute points to the FreshRSS logout/CSRF endpoint, e.g., <track src="http://target-freshrss.local/i/?c=auth&a=login&u=attacker"> or <track src="http://target-freshrss.local/i/?c=javascript&a=nonce&u=attacker">.
3. Host the feed: Serve the malicious feed XML file on an attacker-controlled web server accessible to the victim.
4. Deliver the feed: Trick the target FreshRSS user into subscribing to the malicious feed, or inject the malicious article into an existing feed the user follows.
5. Trigger logout: When the authenticated user views the feed article in FreshRSS, the browser automatically fetches the <track src> URL, sending a cross-origin request to the FreshRSS instance. This triggers FreshRSS_Context::initUser() with an arbitrary username, causing a session mismatch and logging the user out.
6. Achieve DoS: The user is repeatedly logged out whenever they view the article, preventing sustained authenticated access to the FreshRSS service (GitHub Advisory, PR #7997).

• Network: Unexpected HTTP GET requests to FreshRSS endpoints such as /i/?c=auth&a=login&u=<arbitrary_value> or /i/?c=javascript&a=nonce&u=<arbitrary_value> originating from browser sessions (not from the user's direct navigation).
• Logs: Web server access logs showing repeated requests to the above endpoints with non-empty u parameters, particularly from the same IP or session that is also fetching feed content; session invalidation events in application logs correlating with feed article views.
• Application Behavior: Users experiencing repeated unexpected logouts from FreshRSS, especially after viewing specific feed articles or categories.

Upgrade FreshRSS to version 1.27.1 or later, which patches both logout CSRF vectors by preventing unsafe FreshRSS_Context::initUser() calls from unauthenticated or cross-origin requests, and by implementing lazy-loading of <track src> elements to prevent automatic browser fetching (PR #7999, PR #7997, PR #7958). As a temporary workaround if immediate upgrade is not possible, consider restricting RSS feed subscriptions to trusted sources only, and implement network-level controls to limit access to the FreshRSS instance from untrusted origins (GitHub Advisory).

The vulnerability was reported by security researcher Inverle and acknowledged by FreshRSS maintainer Alkarex, who coordinated the fix across three pull requests and published the advisory on December 18, 2025. The fix was incorporated into the 1.27.1 milestone and the unsafe autologin feature was moved to an optional extension in the subsequent 1.28.0 release. Community reaction has been minimal given the moderate severity and limited exploitation potential (GitHub Advisory, PR #7958).