CVE-2026-21885

{"id": "CVE-2026-21885", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21885", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T14:52:34.949191Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "miniflux", "product": "v2", "versions": [{"status": "affected", "version": "< 2.2.16"}]}]}], "published": "2026-01-08T14:15:57.257", "references": [{"url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue."}, {"lang": "es", "value": "Miniflux 2 es un lector de feeds de c\u00f3digo abierto. Antes de la versi\u00f3n 2.2.16, el endpoint de proxy de medios de Miniflux ('GET /proxy/{encodedDigest}/{encodedURL}') puede ser abusado para realizar Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF). Un usuario autenticado puede hacer que Miniflux genere una URL de proxy firmada para URLs de medios elegidas por el atacante incrustadas en el contenido de la entrada del feed, incluyendo direcciones internas (p. ej., localhost, rangos privados RFC1918 o endpoints de metadatos de enlace local). Solicitar la URL resultante '/proxy/...' hace que Miniflux obtenga y devuelva la respuesta interna. La versi\u00f3n 2.2.16 corrige el problema."}], "lastModified": "2026-06-17T10:19:05.410", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "145FED28-3379-45DD-B388-01F5ADF6A766", "versionEndExcluding": "2.2.16", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}