CVE-2026-21885 — Server-Side Request Forgery in V2
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 86.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 8
Latest updateJan 12
Description
Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflu…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages5 packages
🔴Vulnerability Details
4OSV▶
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app↗2026-01-12
OSV▶
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources↗2026-01-07
GHSA▶
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources↗2026-01-07
📋Vendor Advisories
1Debian▶
CVE-2026-21885: miniflux - Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's me...↗2026