{"id":38202,"date":"2025-05-14T20:52:16","date_gmt":"2025-05-14T20:52:16","guid":{"rendered":""},"modified":"2025-05-30T11:19:48","modified_gmt":"2025-05-30T17:19:48","slug":"cve-2025-26845-critical-eval-injection-vulnerability-in-znuny","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-26845-critical-eval-injection-vulnerability-in-znuny\/","title":{"rendered":"<strong>CVE-2025-26845: Critical Eval Injection Vulnerability in Znuny<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>Eval Injection vulnerabilities present a critical risk to system security, and the recent discovery of CVE-2025-26845 in Znuny up to version 7.1.3 is no exception. Anyone with write access to the configuration file can leverage this vulnerability, leading to potential system compromise or data leakage. This issue is particularly troubling because the user running the backup.pl script can inadvertently <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-42136-arbitrary-command-execution-vulnerability-in-pax-android-pos-devices\/\"  data-wpil-monitor-id=\"51806\">execute a malicious command<\/a>, unknowingly causing significant harm.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-26845<br \/>\nSeverity: Critical (CVSS score: 9.8)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: Low<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-4050-heap-corruption-in-google-chrome-devtools-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"43092\">Potential system<\/a> compromise or data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-2890448803\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>Znuny | Up to and including 7.1.3<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>An attacker with write access to the configuration file can <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-2421-critical-code-injection-vulnerability-in-profelis-informatics-sambabox\/\"  data-wpil-monitor-id=\"42914\">inject malicious code<\/a> into the file. This injected <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-37446-arbitrary-code-execution-vulnerability-in-gtkwave-3-3-115\/\"  data-wpil-monitor-id=\"42954\">code is then executed<\/a> when the backup.pl script is run by a user. The script, not designed to validate or sanitize the contents of the configuration file, blindly processes the injected code, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-46739-unauthenticated-brute-force-attack-leads-to-account-compromise\/\"  data-wpil-monitor-id=\"46410\">leading to the execution of the attacker\u2019s<\/a> command.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-2691463052\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Imagine that an attacker has gained write access to the configuration file and decides to <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-32383-code-injection-vulnerability-in-macos-xcode-binaries\/\"  data-wpil-monitor-id=\"48397\">inject the following malicious code<\/a>:<\/p>\n<pre><code class=\"\" data-line=\"\">; rm -rf \/ --no-preserve-root # deletes everything in the filesystem<\/code><\/pre>\n<p>When the backup.pl script is run, it would execute this command, causing the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-45238-arbitrary-file-deletion-vulnerability-in-foxcms-v1-2-5\/\"  data-wpil-monitor-id=\"43128\">deletion of all files<\/a> in the filesystem.<\/p>\n<p><strong>Impact<\/strong><\/p>\n<p>A successful exploit of this vulnerability could lead to a complete system compromise, data leakage, or even a total system crash if <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-13418-critical-arbitrary-file-upload-vulnerability-in-multiple-wordpress-plugins-and-themes\/\"  data-wpil-monitor-id=\"42933\">critical system files<\/a> are deleted. Depending on the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-45042-command-injection-vulnerability-in-tenda-ac9-v15-03-05-14\/\"  data-wpil-monitor-id=\"42950\">injected command<\/a>, an attacker could potentially gain unauthorized access, extract sensitive information, or disrupt the normal operation of the system.<\/p>\n<p><strong>Mitigation<\/strong><\/p>\n<p>As a temporary mitigation, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used to detect and <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-38657-out-of-bounds-write-vulnerability-in-gtkwave-lxt2-zlib-block-decompression\/\"  data-wpil-monitor-id=\"43152\">block attempts to exploit this vulnerability<\/a>. However, the most effective solution is to apply the vendor-supplied patch. Znuny has already released a patch for this issue, and users are urged to apply this update as soon as possible to prevent potential exploits.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview Eval Injection vulnerabilities present a critical risk to system security, and the recent discovery of CVE-2025-26845 in Znuny up to version 7.1.3 is no exception. Anyone with write access to the configuration file can leverage this vulnerability, leading to potential system compromise or data leakage. This issue is particularly troubling because the user running [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-38202","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/38202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=38202"}],"version-history":[{"count":10,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/38202\/revisions"}],"predecessor-version":[{"id":46364,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/38202\/revisions\/46364"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=38202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=38202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=38202"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=38202"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=38202"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=38202"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=38202"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=38202"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=38202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}