What’s Vulnerable › Vulnerabilities

CVE-2025-15585

• Severity: medium (CVSS 6.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-19 · updated 2026-06-17
• Weakness: CWE-89

Description

Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation requires the system to use MySQL as the underlying database and could result in privilege escalation or data exfiltration.

Affected products

• fileflows: before 25.05.2 — fixed in 25.05.2

How to fix

Upgrade to a fixed version: fileflows 25.05.2. Check the vendor advisory for mitigations.

References

• https://fileflows.com/docs/versions#version-2505
• https://projectblack.io/blog/fileflows-sql-injection-by-decompiling-net-code/#exploitation

Get alerted when CVE-2025-15585 or the next vulnerability affects your stack