CVE catalog

CVE-2025-31483

govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianminiflux132.2.10-1vulnerable
Debianminiflux132.2.11-1vulnerable
Debianminiflux132.2.12-1vulnerable
Debianminiflux132.2.13-1vulnerable
Debianminiflux132.2.16-1vulnerable
Debianminiflux132.2.16-2vulnerable
Debianminiflux132.2.19-1vulnerable
Debianminiflux132.2.19-2vulnerable
Debianminiflux132.2.6-1vulnerable
Debianminiflux132.2.6-2vulnerable
Debianminiflux132.3.0-1vulnerable
Debianminiflux132.3.2-1vulnerable
Debianminiflux132.3.3-1vulnerable
Debianminiflux142.2.10-1vulnerable
Debianminiflux142.2.11-1vulnerable
Debianminiflux142.2.6-1vulnerable
Debianminiflux142.2.6-2vulnerable
Debianminiflux142.2.12-1fixed
Opensusegovulncheck-vulndbtumbleweed0.0.20250409T170536-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianminifluxdeb142.2.12-1Not reportedDEBIAN-CVE-2025-31483Not reported
Opensusegovulncheck-vulndbrpmtumbleweed0.0.20250409T170536-1.1Not reportedOPENSUSE-SU-2025:14982-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [miniflux]Affected

    Source package: [miniflux]

    Details (2)

    • 2.2.6-1+b4 · amd64 · trixie

      Affected

      pypi · miniflux · debian · 13

    • 2.2.6-1+b4 · arm64 · trixie

      Affected

      pypi · miniflux · debian · 13

[openSUSE Tumbleweed]

  • [govulncheck-vulndb]Fixed

    Source package: [govulncheck-vulndb]

    Details (1)

    • 0.0.20260828T144745-1.1 · noarch · tumbleweed

      Fixed · Fixed: 0.0.20250409T170536-1.1

      pypi · govulncheck-vulndb · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]