{"id":"CVE-2025-26794","published":"2025-02-21T00:00:00Z","modified":"2025-12-18T18:21:01Z","title":"Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection","vendor":"Exim","product":"Exim","tier":"core","eol":null,"affectedVersions":[{"vendor":"Exim","product":"Exim","versions":[">= 4.98, < 4.98.1"]}],"description":{"text":"Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an SQL injection in Exim 4.98 (before 4.98.1), in the handling of SQLite hints and ETRN serialization within the Exim mail transfer agent. An attacker with remote network access and no authentication or user interaction can inject SQL into the affected code path, which in certain non-default rate-limit configurations is only fully resolved by updating to 4.99.1.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:10Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.77486,"percentile":0.99559,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://exim.org","tags":[]},{"url":"https://github.com/Exim/exim/wiki/EximSecurity","tags":[]},{"url":"https://www.exim.org/static/doc/security/CVE-2025-26794.txt","tags":[]},{"url":"https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305","tags":[]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1237424","tags":[]},{"url":"https://github.com/NixOS/nixpkgs/pull/383926","tags":[]},{"url":"https://github.com/openbsd/ports/commit/584d2c49addce9ca0ae67882cc16969104d7f82d","tags":[]},{"url":"https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/19/1","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/21/4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/21/5","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-4451","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-4451","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-02-22","earliestUrl":"https://github.com/OscarBataille/CVE-2025-26794","repos":[{"name":"OscarBataille/CVE-2025-26794","url":"https://github.com/OscarBataille/CVE-2025-26794","stars":14,"created":"2025-02-22"},{"name":"XploitGh0st/CVE-2025-26794-exploit","url":"https://github.com/XploitGh0st/CVE-2025-26794-exploit","stars":2,"created":"2025-10-31"}]},"first":{"date":"2025-02-22","source":"PoC-in-GitHub","url":"https://github.com/OscarBataille/CVE-2025-26794"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-02-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-26794","provenance":"source"},{"date":"2025-02-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/OscarBataille/CVE-2025-26794","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9956"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}