Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-30 | 1 | General1 |
| 2026-03-07 | 1 | Disclosure1 |
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources · CVE-2026-21885 · GitHub Advisory Database https://github.com/advisories/GHSA-xwh2-742g-w3wp うーむ
Post summary
The tweet announces the discovery of an SSRF flaw (CVE‑2026‑21885) in Miniflux’s media proxy, but does not mention PoC code, exploits, active attacks, or patches.
https://nvd.nist.gov/vuln/detail/CVE-2026-21885 https://github.com/miniflux/v2/security/advisories/GHSA-xwh2-742g-w3wp SSRF Vulnerabilities in miniflux
Post summary
The text briefly references SSRF vulnerabilities in miniflux, linking to an NVD entry and a GitHub advisory, but provides limited detail.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | miniflux_project | miniflux | - | go | - |