CVE-2025-8264 json
z-push/z-push-dev SQL Injection Vulnerability
published last yr. modified 2mo ago also GHSA-w832-w3p8-cw29 , EUVD-2025-22977
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM', ''); or php define('IMAP_DEFAULTFROM', 'ldap');
Patch / fix
- packagist z-push/z-push-dev 2.7.6
- n/a z-push/z-push-dev 2.7.6
- github.com/Z-Hub/Z-Push#161 commit
- github.com/Z-Hub/Z-Push@deb044a commit
- github.com/Z-Hub/Z-Push#161 pull request
Is CVE-2025-8264 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P |
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P |
| CNA | 4.0 | 7.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | z-push/z-push-dev | <2.7.6 |
2.7.6 |
Affected products
- n/a z-push/z-push-dev
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/Z-Hub/Z-Push/pull/161/commits/f981d515a35ac4c303959af21dce880a5db02786
web
-
github.com
/Z-Hub/Z-Push/pull/161
web
-
github.com
/Z-Hub/Z-Push/commit/deb044a40e97dab1814da9aa8330c0a590957fc5
web
-
security.snyk.io
/vuln/SNYK-PHP-ZPUSHZPUSHDEV-10908180
web
- xbow.com /blog/xbow-zpush-sqli/
-
github.com
/Z-Hub/Z-Push/blob/af25a2169a50d6e05a5916d1e8b2b6cd17011c98/src/backend/imap/user_identity.php%23L211C9-L214C2
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-8264
advisory
-
github.com
/Z-Hub/Z-Push
package
-
xbow.com
/blog/xbow-zpush-sqli
web
Sources
- CVE List CVE-2025-8264
- GitHub Advisory GHSA-w832-w3p8-cw29
- NVD CVE-2025-8264
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.