This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Exim fixes a high-severity vulnerability

Exim fixes a high-severity vulnerability in version 4.98.1 [1]. The most widespread operating system releases do not contain the vulnerable version of Exim [2][3][4][5].

Exim - SQL injection útok (CVE 2025-26794)
CVSS 7.5 (High)

An unauthenticated remote attacker can carry out an SQL injection attack, which may lead to a DoS attack (from the perspective of both the affected machine and mail recipients) and unauthorized access to information, potentially including the content of e-mail messages to be sent using the ETRN mechanism. The vulnerability is exploitable only if SQLite is used for the auxiliary database and the ETRN serialization mechanism is enabled [6][7]. A PoC has been published for the vulnerability [7]. Ways to verify whether your instance is vulnerable can be found at [6]

The vulnerability is present in product:

  • *:Exim; >=4.98, <4.98.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

  • CVE-2025-26794 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 21. 2. 2025.

By CESNET, z.s.p.o. Martin Krajči on 25. 2. 2025.

CESNET, z.s.p.o. Logo