Which versions of Z-Push are affected by CVE-2025-8264?

CVE-2025-8264 is a critical SQL injection vulnerability in Z-Push's IMAP backend that allows unauthenticated attackers to access, modify, or delete data in connected databases when non-default SQL…. A patch is available.

How to fix or mitigate CVE-2025-8264?

Within 24 hours: Identify all Z-Push deployments and determine which systems have IMAP_FROM_SQL_QUERY configuration enabled; disable this feature if non-critical to operations. Within 7 days: Implement network-level access controls to restrict Z-Push IMAP backend endpoints to trusted networks only; review database access logs for indicators of exploitation. Within 30 days: Upgrade to Z-Push 2.7.6 or later once released; validate patch availability through official Z-Push project channels (https://github.com/Z-Hub/Z-Push).

Z-Push CVE-2025-8264

Q: What is the CVSS score of CVE-2025-8264?

CVE-2025-8264 has a CVSS 4.0 base score of 7.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

SQL Injection (CWE-89)

2025-07-29 report@snyk.io

PHP Information Disclosure SQLi

7.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:15 vuln.today

DescriptionCVE.org

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. Note: This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM', ''); or php define('IMAP_DEFAULTFROM', 'ldap');

AnalysisAI

SQL injection in Z-Push IMAP backend allows unauthenticated remote attackers to access, modify, or delete data in linked third-party databases via malicious username values in basic authentication headers. Exploitation requires non-default IMAP_FROM_SQL_QUERY configuration. Publicly available exploit code exists (GitHub PR #161 demonstrates the vulnerability). CVSS 7.9 with network attack vector and no authentication required, though attack complexity increases due to the specific configuration prerequisite. Affects Z-Push versions before 2.7.6.

Technical ContextAI

Z-Push is a PHP-based open-source implementation of the Microsoft ActiveSync protocol for mobile device synchronization with email servers. The vulnerability resides in the IMAP backend component (backend/imap/user_identity.php, lines 211-214), where username values from HTTP basic authentication are directly interpolated into SQL queries without parameterization when IMAP_FROM_SQL_QUERY is configured. This represents a classic CWE-89 SQL injection flaw where user-controlled input (the username field in Authorization headers) flows unsanitized into database operations. The IMAP backend's user identity feature allows querying external SQL databases to retrieve email addresses for users, but the query construction lacks prepared statements or input validation. The vulnerable code path only executes when administrators have explicitly configured IMAP_FROM_SQL_QUERY to query a third-party database rather than using default settings or LDAP.

Affected ProductsAI

Z-Push versions before 2.7.6 are affected when the IMAP backend is enabled with IMAP_FROM_SQL_QUERY configured to query external SQL databases. The package identifier is z-push/z-push-dev in PHP/Composer ecosystems. Specifically, the vulnerability exists in backend/imap/user_identity.php in the user identity resolution code path. GitHub repository Z-Hub/Z-Push versions prior to commit f981d515a35ac4c303959af21dce880a5db02786 contain the vulnerable unparameterized query construction. Organizations using default IMAP_DEFAULTFROM settings or LDAP-based identity resolution are not affected even if running vulnerable versions. Advisory available at https://security.snyk.io/vuln/SNYK-PHP-ZPUSHZPUSHDEV-10908180 and technical analysis at https://xbow.com/blog/xbow-zpush-sqli/.

RemediationAI

Upgrade to Z-Push version 2.7.6 or later, which implements parameterized queries in the IMAP backend user identity code (fix available via GitHub PR #161, commit f981d515a35ac4c303959af21dce880a5db02786). For systems that cannot immediately upgrade, remove SQL injection attack surface by changing backend/imap/config.php to use default settings (define('IMAP_DEFAULTFROM', '');) or LDAP-based identity resolution (define('IMAP_DEFAULTFROM', 'ldap');) instead of IMAP_FROM_SQL_QUERY. This configuration change eliminates the vulnerable code path entirely but impacts functionality for deployments that rely on SQL database queries for user email address resolution - organizations must ensure alternative identity resolution mechanisms meet their operational requirements. If SQL-based identity resolution is business-critical and patching is delayed, implement input validation at the web server or reverse proxy layer to sanitize HTTP Authorization headers, though this is complex and error-prone compared to patching. Monitor database query logs for suspicious username patterns (SQL keywords, comment sequences, UNION statements) as a detection control. Vendor patch details: https://github.com/Z-Hub/Z-Push/pull/161.