SQL Injection Vulnerability in Z-Push IMAP Backend by Z-Push Development Team

CVE-2025-8264

What is CVE-2025-8264?

Versions of Z-Push prior to 2.7.6 contain a vulnerability in the IMAP backend due to the use of unparameterized queries. This weakness allows attackers to execute SQL Injection attacks by crafting malicious inputs, particularly through the username field during basic authentication. Consequently, unauthorized individuals may gain access to sensitive information, modify data, or delete records in a linked third-party database. It is crucial for users to configure their IMAP settings securely and consider switching to LDAP to mitigate this risk.

References