CVE-2025-26794

HIGH

Exim 4.98 - Remote SQL Injection via SQLite Hints and ETRN Serialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2025-26794. PoCs published by OscarBataille, XploitGh0st, ishwardeepp.

AI-analyzed exploit summary This repository contains a working proof-of-concept for CVE-2025-26794, a blind SQL injection vulnerability in Exim 4.98 when using SQLite as the DBM. The exploit leverages the ETRN command to inject arbitrary SQLite queries, demonstrated via a time-based payload.

Description

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Exploits (3)

nomisec WORKING POC 14 stars
by OscarBataille · poc
https://github.com/OscarBataille/CVE-2025-26794

This repository contains a working proof-of-concept for CVE-2025-26794, a blind SQL injection vulnerability in Exim 4.98 when using SQLite as the DBM. The exploit leverages the ETRN command to inject arbitrary SQLite queries, demonstrated via a time-based payload.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Exim 4.98 with SQLite DBM
No auth needed
Prerequisites: Exim compiled with SQLite support · ETRN command enabled in Exim configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC 2 stars
by XploitGh0st · pythonpoc
https://github.com/XploitGh0st/CVE-2025-26794-exploit

This repository contains a functional Python-based exploit for CVE-2025-26794, demonstrating SQL injection in Exim 4.98 via the ETRN command when using SQLite DBM storage. The exploit includes time-based blind SQL injection techniques for data extraction and automated database enumeration.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Exim 4.98 with SQLite DBM
No auth needed
Prerequisites: Network access to SMTP service (port 25) · Exim 4.98 configured with SQLite DBM
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec STUB
by ishwardeepp · poc
https://github.com/ishwardeepp/CVE-2025-26794-Exim-Mail-SQLi

The repository contains Docker setup scripts for Exim but lacks actual exploit code for CVE-2025-26794. The commented SQLi payload in start-exim.sh suggests an SQL injection vulnerability but is not functional.

Classification
Stub 70%
Attack Type
Sqli
Complexity
Moderate
Reliability
Theoretical
Target: Exim Mail Server (version unspecified)
No auth needed
Prerequisites: Docker environment · Exim Mail Server installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.7578
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
exim/exim 4.98 - 4.98.1
Published Feb 21, 2025
Tracked Since Feb 18, 2026