Loading vulnerability…
CVE-2025-26794 is a remote SQL injection vulnerability in Exim affecting 4.98 before 4.98.1 when SQLite hints are enabled and ETRN serialization is used. The issue is described as improper filtering/escaping of single-quote characters in data incorporated into SQLite queries. Supporting content indicates Exim’s SQLite hints code interpolates attacker-controlled keys into SQL statements, and the original flaw was reachable via crafted SMTP ETRN commands. Additional reporting states the initial fix addressed the ETRN-specific path in 4.98.1, but did not fully eliminate the broader SQL injection primitive in certain non-default ratelimit configurations; complete remediation for those cases requires updating to 4.99.1. The vulnerability allows remote injection into Exim’s SQLite-backed hints database operations under affected configurations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides a detailed writeup and proof-of-concept (PoC) exploit for CVE-2025-26794, a blind SQL injection vulnerability in Exim 4.98 when built with SQLite as the DBM backend. The vulnerability arises from unsanitized input in the ETRN SMTP command, allowing an attacker to inject arbitrary SQL into the SQLite HintsDB. The repository includes: - A comprehensive README.md explaining the vulnerability, exploitation method, and impact. - A Docker-based lab (docker_lab/) for setting up a vulnerable Exim 4.98 environment with SQLite support, including Dockerfile, configuration files, and helper scripts for building and running the lab. - A Python script (test.py) that connects to a target SMTP server on port 25, issues the ETRN command, and sends a time-based blind SQL injection payload to test for the vulnerability. The exploit requires the target to have Exim 4.98 compiled with SQLite support and the ETRN command enabled. The main attack vector is network-based, leveraging the SMTP protocol. The PoC demonstrates the ability to perform blind SQL injection, which could be used for data manipulation, denial of service, or potentially further exploitation if chained with other SQLite vulnerabilities. The repository is structured for both research and practical testing, with clear instructions and automation for lab setup and exploitation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical SQL injection vulnerability in Exim's database cleaning function that can be used to inject malicious database commands and corrupt memory as part of a chain leading to mail server compromise.
A security vulnerability in Exim. Specific details not provided in the content.
An incomplete SQL injection fix in Exim 4.99 with SQLite hints database support, allowing attackers to execute arbitrary SQL queries via specially crafted SMTP commands.
A SQL injection vulnerability in Exim's SQLite hints database handling, originally assigned for ETRN-command input. The content says its patch was incomplete because single quotes were not escaped, leaving the underlying injection primitive in place for other attack vectors.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.