CVE-2025-15585
Authenticated SQL Injection in Fileflows Library-File Search Risks Escalation
Publication date: 2026-02-19
Last updated on: 2026-02-19
Assigner: ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fileflows | fileflows | to 25.05.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-15585 is an authenticated SQL injection vulnerability found in FileFlows versions before 25.05.2, specifically in the library-file search function.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the application constructs SQL queries by concatenating user input with minimal sanitization, allowing malicious input to manipulate the SQL commands executed against the database.'}, {'type': 'paragraph', 'content': "This flaw is exploitable only when the system uses MySQL as the underlying database, due to MySQL's support for C-style backslash escaping and multiple query execution."}] [2]
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to privilege escalation or data exfiltration.
An attacker could inject malicious SQL commands to escalate their privileges, for example by updating user roles to admin, or extract sensitive data from the database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'The vulnerability is an authenticated SQL injection in the FileFlows library-file search function, specifically in the POST /api/library-file/search endpoint. Detection involves monitoring or testing this API endpoint for SQL injection attempts.'}, {'type': 'paragraph', 'content': 'Since the vulnerability arises from unsafe SQL query construction using user input in the LibraryFileSearchModel filter, detection can be attempted by sending crafted payloads to the search API that include SQL injection patterns, especially targeting MySQL-specific escape sequences like backslashes (\\) and comments (/**/).'}, {'type': 'paragraph', 'content': 'Example detection commands could include using curl or similar tools to send POST requests with suspicious payloads in the LibraryName parameter, such as:'}, {'type': 'list_item', 'content': 'curl -X POST https://<fileflows-server>/api/library-file/search -H \'Content-Type: application/json\' -d \'{"LibraryName": "test\\\' OR 1=1 -- "}\''}, {'type': 'list_item', 'content': 'curl -X POST https://<fileflows-server>/api/library-file/search -H \'Content-Type: application/json\' -d \'{"LibraryName": "test\\\'; DROP TABLE users; -- "}\''}, {'type': 'paragraph', 'content': 'Successful exploitation or error messages indicating SQL syntax errors or unexpected behavior may confirm the presence of the vulnerability.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves upgrading FileFlows to a version where the vulnerability is fixed. The fix was verified and released in version 25.05 under FF-2238.
If upgrading immediately is not possible, restrict access to the vulnerable API endpoint to trusted users only, as exploitation requires authentication.
Additionally, if your system uses MySQL as the underlying database, consider monitoring and blocking suspicious input patterns that could exploit SQL injection, such as backslash escapes and comment sequences.
Longer term, ensure that the application uses parameterized queries or ORM methods that avoid direct string concatenation with user input.