CVE catalog

CVE-2026-21885

UBUNTU-CVE-2026-21885

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianminiflux132.2.10-1vulnerable
Debianminiflux132.2.11-1vulnerable
Debianminiflux132.2.12-1vulnerable
Debianminiflux132.2.13-1vulnerable
Debianminiflux132.2.16-1vulnerable
Debianminiflux132.2.16-2vulnerable
Debianminiflux132.2.19-1vulnerable
Debianminiflux132.2.19-2vulnerable
Debianminiflux132.2.6-1vulnerable
Debianminiflux132.2.6-2vulnerable
Debianminiflux132.3.0-1vulnerable
Debianminiflux132.3.2-1vulnerable
Debianminiflux132.3.3-1vulnerable
Debianminiflux142.2.10-1vulnerable
Debianminiflux142.2.11-1vulnerable
Debianminiflux142.2.12-1vulnerable
Debianminiflux142.2.13-1vulnerable
Debianminiflux142.2.6-1vulnerable
Debianminiflux142.2.6-2vulnerable
Debianminiflux142.2.16-1fixed
Ubuntuminifluxpro2.2.6-2vulnerable
Ubuntuminifluxpro2.2.13-1vulnerable
Ubuntuminifluxpro2.2.16-2vulnerable
Ubuntuminifluxpro2.2.16-2ubuntu0.26.04.1~esm1vulnerable
Ubuntuminiflux25.102.2.6-1vulnerable
Ubuntuminiflux25.102.2.6-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianminifluxdeb142.2.16-1Not reportedDEBIAN-CVE-2026-21885Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [miniflux]Affected

    Source package: [miniflux]

    Details (2)

    • 2.2.6-1+b4 · amd64 · trixie

      Affected

      pypi · miniflux · debian · 13

    • 2.2.6-1+b4 · arm64 · trixie

      Affected

      pypi · miniflux · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]