Executive brief
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
Affected products
- Go miniflux.app
- Go miniflux.app/v2
Junglewise Threat Intelligence
CVE-2026-21885: GO-2026-4287 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
CVE-2026-21885 · Severity: low · CVSS 3.1 · Published 2026-01-12
Technologies: miniflux.app (Go), miniflux.app/v2 (Go). Vendors: Go.
Related threats
- Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backs
- GO-2025-4226 - Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
- GO-2025-3591 - Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
- Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
- Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics