Fluid Attacks Database

Description

Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	miniflux	=2.2.10-1 \|\| =2.2.11-1 \|\| =2.2.12-1 \|\| =2.2.13-1 \|\| =2.2.16-1 \|\| =2.2.16-2 \|\| =2.2.19-1 \|\| =2.2.19-2 \|\| =2.2.6-1 \|\| =2.2.6-2	-
debian 14	miniflux	=2.2.10-1 \|\| =2.2.11-1 \|\| =2.2.12-1 \|\| =2.2.13-1 \|\| =2.2.6-1 \|\| =2.2.6-2 \|\| >=0 <2.2.16-1	2.2.16-1
go	miniflux.app/v2	>=0 <2.2.16	2.2.16
go	miniflux.app	-	-

Aliases

1. CVE-2026-218852. NVD-2026-218853. OSV-DEBIAN-2026-218854. OSV-2026-218855. OSV-GO-2026-42876. GHSA-xwh2-742g-w3wp7. GCVE-2026-218858. SECURITY-TRACKER-CVE-2026-218859. GHSA-xwh2-742g-w3wp

References

1. https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp