miniflux CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM miniflux CVE published 2026-10-11

CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. This vulnerability enables attackers to bypass FETCHER_ALLOW_PRIVATE_NETWORKS checks, potentially probing internal ports and sending proxy-style requests to internal services. Defenders should assess exposure and verify compensating co [truncated]