CVE-2025-26794CWE-89

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection

High · published February 21, 2025

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.6th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

77%

Percentile

99.6

In the wild

Unconfirmed

What it is

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.77486 · 99.6th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-02-21T00:00Z

EPSS history

Timeline

21 FEB 00:00Z
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection
cvelistv5