GO-2025-4226
NoneCVSS
—
EPSS
—
Published
Dec 15, 2025
CISA due date
—
The record
Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | miniflux.app | 0 | No fix |
| Go | miniflux.app/v2 | 0 | 2.2.15 |
Related vulnerabilities
- CVE-2025-67713 Miniflux 2 is an open source feed reader. Same vulnerability
- GO-2026-4287 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources… Also affects miniflux.app
- CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources Also affects miniflux.app