CVE-2025-26794

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26794
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=1237424 Third Party Advisory Issue Tracking
https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305 Patch
https://exim.org Product
https://github.com/Exim/exim/wiki/EximSecurity Vendor Advisory
https://github.com/NixOS/nixpkgs/pull/383926 Release Notes
https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d Patch
https://www.exim.org/static/doc/security/CVE-2025-26794.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/02/19/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/02/21/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/02/21/5 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
History

25 Sep 2025, 13:12

Type Values Removed Values Added
CPE cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
First Time Exim exim
Exim
References () https://bugzilla.suse.com/show_bug.cgi?id=1237424 - () https://bugzilla.suse.com/show_bug.cgi?id=1237424 - Third Party Advisory, Issue Tracking
References () https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305 - () https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305 - Patch
References () https://exim.org - () https://exim.org - Product
References () https://github.com/Exim/exim/wiki/EximSecurity - () https://github.com/Exim/exim/wiki/EximSecurity - Vendor Advisory
References () https://github.com/NixOS/nixpkgs/pull/383926 - () https://github.com/NixOS/nixpkgs/pull/383926 - Release Notes
References () https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d - () https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d - Patch
References () https://www.exim.org/static/doc/security/CVE-2025-26794.txt - () https://www.exim.org/static/doc/security/CVE-2025-26794.txt - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2025/02/19/1 - () http://www.openwall.com/lists/oss-security/2025/02/19/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2025/02/21/4 - () http://www.openwall.com/lists/oss-security/2025/02/21/4 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2025/02/21/5 - () http://www.openwall.com/lists/oss-security/2025/02/21/5 - Mailing List, Third Party Advisory

22 Feb 2025, 01:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/02/21/4 -
  • () http://www.openwall.com/lists/oss-security/2025/02/21/5 -

21 Feb 2025, 19:15

Type Values Removed Values Added
Summary
  • (es) Exim 4.98 anterior a la versíon 4.98.1 permite una inyección SQL remota cuando se usan serialización de ETRN con la tabla hints en SQLite.
References
  • () https://bugzilla.suse.com/show_bug.cgi?id=1237424 -
  • () https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305 -
  • () https://github.com/Exim/exim/wiki/EximSecurity -
  • () https://github.com/NixOS/nixpkgs/pull/383926 -
  • () https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d -

21 Feb 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-21 13:15

Updated : 2025-09-25 13:12

NVD link : CVE-2025-26794

Mitre link : CVE-2025-26794

CVE.ORG link : CVE-2025-26794

JSON object : View

Products Affected

exim

  • exim
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')