CVE-2025-21628: Chatwoot has a Blind SQL-injection in Conversation and Contacts filters

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-09 · updated 2026-06-17
Weakness: CWE-89

Description

Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.

Affected products

chatwoot/chatwoot: from 2.16.1 before 3.16.0 — fixed in 3.16.0

How to fix

Upgrade to a fixed version: chatwoot/chatwoot 3.16.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-21628 or the next vulnerability affects your stack