The vulnerability is in PHP. This FreshRSS release addresses the vulnerability by updating the version of PHP in the container image. If you’re not using the official FreshRSS container image, you just need to update your PHP.