Home

Description

Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation requires the system to use MySQL as the underlying database and could result in privilege escalation or data exfiltration.

PUBLISHED Reserved 2026-02-18 | Published 2026-02-18 | Updated 2026-02-18 | Assigner PRJBLK




MEDIUM: 6.7CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version before 25.05.2
affected

References

fileflows.com/docs/versions

projectblack.io/...ws-sql-injection-by-decompiling-net-code/

cve.org (CVE-2025-15585)

nvd.nist.gov (CVE-2025-15585)

Download JSON