# CVE-2025-31483: Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration

Source: https://junglewise.ai/threats/cve-2025-31483-miniflux-media-proxy-vulnerable-to-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-09  
License: CC BY 4.0 with a link back

CVE-2025-31483 · Severity: medium · CVSS 4 · Published 2025-04-09

Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app

Technologies: [miniflux.app (Go)](https://junglewise.ai/threats/technologies/miniflux-app), [miniflux.app/v2 (Go)](https://junglewise.ai/threats/technologies/miniflux-app-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-31483 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-31483 being exploited in the wild.

**How severe is CVE-2025-31483?** Medium severity, with a CVSS score of 4, published 9 April 2025.

**Which products and versions are affected?** miniflux.app (Go) SEMVER:introduced=0; miniflux.app/v2 (Go) SEMVER:introduced=0,fixed=2.2.7.

**Is there a fix for CVE-2025-31483?** Yes. miniflux.app/v2 (Go): upgrade to 2.2.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-31483?** Check whether you run miniflux.app (Go) or miniflux.app/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- miniflux.app/v2 (Go): upgrade to 2.2.7 or later

  ```sh
  go get miniflux.app/v2@v2.2.7
  ```


## Affected products

- miniflux.app (Go) SEMVER:introduced=0
- miniflux.app/v2 (Go) SEMVER:introduced=0,fixed=2.2.7

## Identifiers

- CVE-2025-31483
- GHSA-cq88-842x-2jhp
- GO-2025-3591

## Related threats

- [Miniflux miniflux-v2 open redirect bypass](https://junglewise.ai/threats/cve-2026-55185-miniflux-miniflux-v2-open-redirect-bypass)
- [GO-2026-4287 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app](https://junglewise.ai/threats/cve-2026-21885-miniflux-media-proxy-ssrf-via-proxy-endpoint-allows-access-to)
- [GO-2025-4226 - Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app](https://junglewise.ai/threats/cve-2025-67713-miniflux-has-an-open-redirect-via-protocol-relative-redirect-url)
- [Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler](https://junglewise.ai/threats/cve-2023-27592-stored-xss-in-miniflux-when-opening-a-broken-image-due-to)
- [Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics](https://junglewise.ai/threats/cve-2023-27591-unauthenticated-miniflux-user-can-bypass-allowed-networks-check)