CVE-2026-108735
MediumCVSS 4.3Summary
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
Risk Assessment
An attacker can access internal services and ports, leading to privilege escalation and potential infrastructure security breaches. The risk also includes using the server as a proxy for attacks on other systems.
Recommendation
Update Miniflux to a version later than 2.3.3 if available, and implement additional controls for proxy_url to block private and loopback addresses. Monitor outbound traffic from the server for unusual connections.
Other vulnerabilities in Miniflux
See all- CVE-2026-55185Medium
Miniflux 2 prior to 2.3.1 accepts redirect targets containing backslashes, which browsers normalize to forward slashes. An unauthenticated attacker can exploit this in the login flow to redirect a victim to an attacker-controlled external site, bypassing relative-path and host checks.
- CVE-2025-67713Medium
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
Original NVD description (English source)
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS