What’s Vulnerable › Vulnerabilities
CVE-2025-6724: Chef Automate SQL Injection Vulnerability
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-29 · updated 2026-10-09
- Weakness: CWE-89
Description
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.
Affected products
- Progress Software Chef Automate: before 4.13.295; from 20180319150121 through 20220329091442 — fixed in 4.13.295
How to fix
Upgrade to a fixed version: Progress Software Chef Automate 4.13.295. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-6724 or the next vulnerability affects your stack