Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-55185: Miniflux 2 can redirect users to external sites
CVE-2026-55185 · published 2 months ago
Summary
The Miniflux 2 feed reader lets a login page send users to a URL you choose. Because of a flaw, an attacker can trick the system into sending users to a malicious website even though the URL looks safe. Updating to version 2.3.1 or later stops this behavior.
What to do
- Update miniflux.app v2 to version 2.3.1.
- Update v2 miniflux.app/v2 to version 2.3.1.
- Update debian miniflux to version 2.3.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:24.04:LTS | canonical | miniflux | All versions |
| go | miniflux.app | v2 |
<= 2.3.0 Fix: upgrade to 2.3.1
|
| Go | v2 | miniflux.app/v2 |
< 2.3.1 Fix: upgrade to 2.3.1
|
| – | miniflux | v2 | < 2.3.1 |
| Debian:13 | debian | miniflux | All versions |
| Debian:14 | debian | miniflux |
< 2.3.2-1 Fix: upgrade to 2.3.2-1
|
Original advisory text
Miniflux 2: Open Redirect Bypass
Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.
References
- https://github.com/miniflux/v2/releases/tag/2.3.1 URL
- https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r Vendor Advisory
- https://github.com/advisories/GHSA-m999-j542-5w3r
- https://github.com/miniflux/v2 Product
- https://github.com/miniflux/v2/commit/c896bafdaa19c3f280b02b1059f84706495f1949 Patch
- https://github.com/miniflux/v2/pull/4362 Patch
- https://security-tracker.debian.org/tracker/CVE-2026-55185 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-55185 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-55185 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55185... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55185 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-601Open Redirect
Timeline
Published21 Aug 2026
Updated4 Nov 2026
First seen19 Jun 2026
Sources
DEBIAN-CVE-2026-55185 · OSV
GHSA-m999-j542-5w3r · GHSA
CVE-2026-55185 · NVD
GHSA-m999-j542-5w3r · OSV
CVE-2026-55185 · MITRE
CVE-2026-55185 · OSV
UBUNTU-CVE-2026-55185 · OSV
Track software like this
Free during beta