CVE-2025-57769 MEDIUM

CVE-2025-57769: FressRSS: Clickjacking can lead to XSS and/or privilege escalation

Vendor Freshrss
Product FreshRSS
Weakness CWE-79 · XSS
Published September 29, 2025
Last update September 30, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0

Key dates

02Disclosure timeline

September 29, 2025 CVE published
September 30, 2025 Record updated