CVE-2026-108735 — Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Atta…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7