This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-108735 →

DEBIAN-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setti...

Original description

The description as published by the source.

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 miniflux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 miniflux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org