CVE-2025-26794
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
Analysis
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN serialization features are enabled. The vulnerability allows remote attackers to inject SQL through crafted SMTP commands, potentially compromising the mail server's configuration and queued messages.
Technical Context
When Exim is configured with SQLite for hint databases and ETRN serialization is enabled, certain SMTP command parameters are incorporated into SQLite queries without proper sanitization. A remote attacker can inject SQL through crafted SMTP ETRN commands, reading or modifying the hint databases. In certain non-default rate-limit configurations, the vulnerability extends to additional SQL contexts.
Affected Products
['Exim 4.98 before 4.98.1', 'Exim configurations using SQLite hints with ETRN serialization']
Remediation
Update to Exim 4.98.1 or 4.99.1. Review Exim configuration for SQLite hints and ETRN serialization usage. If these features are not needed, disable them. Monitor SMTP logs for unusual ETRN commands.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today