v2
2.3.5Minimalist and opinionated feed reader
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 10 advisories6 medium, 4 low · Scorecard 7.5/10
- Supported versions
- No scheduleendoflife.date does not track this project
9.9k stars · 968 forks · 289 open issues · last release 13 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 10 most recent advisories published by the maintainers: 6 medium, 4 low. Check the patched version against the one you run.
- lowGHSA-ch38-3q93-fwg8Nov 12, 2026Password changes did not require the current password or sign out existing sessions
- Affected
- < 2.3.5
- Patched in
- 2.3.5
- mediumGHSA-fxf9-xrcf-cjcmNov 7, 2026SSRF filter bypass via unblocked reserved IP ranges (NAT64, cloud metadata, benchmarking)
- Affected
- >= 2.2.18, < 2.3.4
- Patched in
- 2.3.4
- mediumGHSA-v673-332q-cq35Nov 7, 2026Stored XSS via javascript: URLs in iframe src attributes
- Affected
- >= 2.0.24, < 2.3.4
- Patched in
- 2.3.4
- mediumGHSA-fwp7-34mv-hm2rNov 7, 2026Cross-user IDOR in the UI enclosure save-progression handler (missing ownership check)
- Affected
- >= 2.0.45, < 2.3.2
- Patched in
- 2.3.2
- lowCVE-2026-55185Jun 18, 2026Open Redirect Bypass in miniflux-v2
- Affected
- 2.3.0
- Patched in
- 2.3.1
- mediumCVE-2026-21885Jan 7, 2026Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
- Affected
- Affected versions: <= 2.2.15
- Patched in
- 2.2.16
- lowCVE-2025-67713Dec 10, 2025Open Redirect via protocol-relative `redirect_url`
- Affected
- <=2.2.14
- Patched in
- >2.2.14
- mediumCVE-2025-31483Apr 3, 2025Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
- Affected
- <2.2.7
- Patched in
- 2.2.7
- mediumCVE-2023-27592Mar 17, 2023Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
- Affected
- <= 2.0.42
- Patched in
- 2.0.43
- lowCVE-2023-27591Mar 17, 2023Unauthenticated user can bypass allowed networks check to obtain Prometheus metrics
- Affected
- <= 2.0.42
- Patched in
- 2.0.43