SimplePie: Local file read via file:// redirects in feed fetching
Summary
SimplePie, a PHP library for parsing Atom and RSS feeds, up to and including version 1.9.0 can be made to read local files. A malicious feed server can return an HTTP redirect (Location header) or feed link that points to a file:// path, and SimplePie then reads that file with file_get_contents(). An attacker can read any file the web server process can access, such as configuration files with credentials, but cannot modify data. Exploitation requires that an attacker can influence which feed URLs the application fetches.
Affected
- SimplePie through 1.9.0 (affected range 0 to and including 1.9.0 per the CVE record)
- Embedded or bundled copies in other software (CMS, plugins, appliances) are affected if they use these versions
- Unknown development builds should be treated as affected
Fixed in
Unknown. No fixed release has been confirmed. Upstream pull requests #991 and #994 address the issue but their release status is not confirmed. The project does not guarantee security fixes for older versions.
Workaround
- No vendor-issued workaround found.
- Restrict who can add or change feed URLs to trusted administrators.
- Limit the web server user's read access to sensitive files such as configuration files with database credentials.
Exploitation
- No known exploitation in the wild. It is not listed in the CISA KEV catalog according to one aggregator.
- A public proof of concept exists: a researcher's repository demonstrates the issue in a pfSense CE development build.
- CISA SSVC: exploitation poc, not automatable.
- EPSS score 0.0031.
Our recommendation
- Inventory all SimplePie installations, including copies bundled in CMS, plugins and appliances, and treat versions up to 1.9.0 as affected.
- Check whether feed fetching is exposed to non-admin users or to the internet, and prioritise those systems.
- Restrict feed URL management to trusted administrators and limit the web server user's file read access.
- Monitor PR #991, PR #994 and upstream releases, and upgrade as soon as a fixed version is published.
- Review the CVSS score and CWE discrepancies between sources when assessing your own priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: SimplePie local file read via file redirect www.vulncheck.com
- CVE record aggregator (Vulners) vulners.com
- SimplePie project repository github.com
- SimplePie pull request #991 github.com
- SimplePie pull request #994 github.com
- SimplePie issue #968 github.com
- VulDB entry 420892 vuldb.com
- Public proof of concept repository (pfSense RSS file redirect) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:57.
Original description (NVD)
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.
NVD references (8)
- https://github.com/abraxas/pfsense-rss-file-redirect
- https://github.com/simplepie/simplepie
- https://github.com/simplepie/simplepie/blob/76cccb1b2c5dcaf44f304c925ab30c0f48643992/src/File.php#L160-L176
- https://github.com/simplepie/simplepie/blob/76cccb1b2c5dcaf44f304c925ab30c0f48643992/src/File.php#L289-L293
- https://github.com/simplepie/simplepie/blob/76cccb1b2c5dcaf44f304c925ab30c0f48643992/src/HTTP/Psr18Client.php…
- https://github.com/simplepie/simplepie/issues/968
- https://github.com/simplepie/simplepie/pull/991
- https://www.vulncheck.com/advisories/simplepie-through-1.9.0-local-file-read-via-file-redirect
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.