Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-55185 →

UBUNTU-CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes bec...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:Pro:24.04:LTS miniflux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:26.04:LTS miniflux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

report ubuntu.com
report cve.org
report github.com
report github.com