CVE catalog

CVE-2026-55185

UBUNTU-CVE-2026-55185

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.56% · Oct 25, 2026

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianminiflux132.2.10-1vulnerable
Debianminiflux132.2.11-1vulnerable
Debianminiflux132.2.12-1vulnerable
Debianminiflux132.2.13-1vulnerable
Debianminiflux132.2.16-1vulnerable
Debianminiflux132.2.16-2vulnerable
Debianminiflux132.2.19-1vulnerable
Debianminiflux132.2.19-2vulnerable
Debianminiflux132.2.6-1vulnerable
Debianminiflux132.2.6-2vulnerable
Debianminiflux132.3.0-1vulnerable
Debianminiflux132.3.2-1vulnerable
Debianminiflux132.3.3-1vulnerable
Debianminiflux142.2.10-1vulnerable
Debianminiflux142.2.11-1vulnerable
Debianminiflux142.2.12-1vulnerable
Debianminiflux142.2.13-1vulnerable
Debianminiflux142.2.16-1vulnerable
Debianminiflux142.2.16-2vulnerable
Debianminiflux142.2.19-1vulnerable
Debianminiflux142.2.19-2vulnerable
Debianminiflux142.2.6-1vulnerable
Debianminiflux142.2.6-2vulnerable
Debianminiflux142.3.0-1vulnerable
Debianminiflux142.3.2-1fixed
Ubuntuminifluxpro2.2.6-2vulnerable
Ubuntuminifluxpro2.2.13-1vulnerable
Ubuntuminifluxpro2.2.16-2vulnerable
Ubuntuminifluxpro2.2.16-2ubuntu0.26.04.1~esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianminifluxdeb142.3.2-1Not reportedDEBIAN-CVE-2026-55185Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [miniflux]Affected

    Source package: [miniflux]

    Details (2)

    • 2.2.6-1+b4 · amd64 · trixie

      Affected

      pypi · miniflux · debian · 13

    • 2.2.6-1+b4 · arm64 · trixie

      Affected

      pypi · miniflux · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]