The flaw is a Server‑Side Request Forgery in the media proxy endpoint that an authenticated user can exploit to force Miniflux to fetch arbitrary URLs. Because the endpoint accepts any encoded URL, an attacker can target internal IPs, including localhost, RFC1918 addresses, or link‑local cloud metadata services. The proxy then returns the fetched content, enabling reading of internal resources and potentially gleaning credentials or other sensitive information.

Miniflux version 2 before 2.2.16 is affected. The vulnerability is present in Miniflux v2 and has been fixed in release 2.2.16, which replaces the media proxy logic to reject internal addresses.

The CVSS score of 6.5 indicates a moderate severity level. The EPSS score is less than 1%, implying a low probability that the flaw will be exploited in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to generate a proxy URL, and once the URL is accessed the server contacts the target address, making the attack vector internal to the application. Attacks that succeed could expose internal services and data, but would not grant direct execution or privilege escalation on the host itself. The combination of moderate severity and low exploitation probability suggests that while monitoring is advisable, immediate actions such as patching are recommended.