SQL Injection Vulnerability in Zabbix Affected by Malicious Admin Input
CVE-2025-27240

7.5HIGH

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
12 September 2025

What is CVE-2025-27240?

An SQL injection vulnerability exists in Zabbix where an administrator can execute arbitrary SQL commands during the autoremoval of hosts by inserting malicious SQL within the 'Visible name' field, allowing for potential database manipulation and unauthorized access to sensitive information.

Affected Version(s)

Zabbix 6.0.0 <= 6.0.33

Zabbix 6.4.0 <= 6.4.18

Zabbix 7.0.0 <= 7.0.3

References

https://support.zabbix.com/browse/ZBX-26986

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank Grzegorz Muszyński (szerszen199) for submitting this report on the HackerOne bug bounty platform.
.
CVE-2025-27240 : SQL Injection Vulnerability in Zabbix Affected by Malicious Admin Input