Executive brief
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Affected products
- Go miniflux.app/v2
Junglewise Threat Intelligence
CVE-2023-27592: Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
CVE-2023-27592 · Severity: low · CVSS 3.1 · Published 2025-04-02
Technologies: miniflux.app/v2 (Go). Vendors: Go.
Related threats
- Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backs
- GO-2026-4287 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
- GO-2025-4226 - Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
- GO-2025-3591 - Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
- Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics