Fluid Attacks Database

Description

Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	miniflux.app	-	-
go	miniflux.app/v2	>=0 <2.2.15	2.2.15
debian 13	miniflux	=2.2.10-1 \|\| =2.2.11-1 \|\| =2.2.12-1 \|\| =2.2.13-1 \|\| =2.2.16-1 \|\| =2.2.16-2 \|\| =2.2.19-1 \|\| =2.2.19-2 \|\| =2.2.6-1 \|\| =2.2.6-2	-
debian 14	miniflux	=2.2.10-1 \|\| =2.2.11-1 \|\| =2.2.12-1 \|\| =2.2.13-1 \|\| =2.2.6-1 \|\| =2.2.6-2 \|\| >=0 <2.2.16-1	2.2.16-1

Aliases

1. CVE-2025-677132. NVD-2025-677133. OSV-GO-2025-42264. OSV-2025-677135. OSV-DEBIAN-2025-677136. GHSA-wqv2-4wpg-8hc97. GCVE-2025-677138. GHSA-wqv2-4wpg-8hc99. SECURITY-TRACKER-CVE-2025-67713

References

1. https://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c72. https://github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.