CVE-2025-21628: Chatwoot has a Blind SQL-injection in Conversation and Contacts filters
Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of queryoperator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21628?
The severity of CVE-2025-21628 is classified as high due to the potential for SQL injection by authenticated users.
How can I fix CVE-2025-21628?
To fix CVE-2025-21628, upgrade to Chatwoot version 3.16.0 or later, which includes input sanitization for the affected endpoints.
Who is affected by CVE-2025-21628?
CVE-2025-21628 affects all users of Chatwoot versions prior to 3.16.0.
What type of vulnerability is CVE-2025-21628?
CVE-2025-21628 is a SQL injection vulnerability related to insufficient input validation in Chatwoot.
Can unprivileged users exploit CVE-2025-21628?
No, only authenticated users can exploit CVE-2025-21628 due to the nature of the vulnerability in the application.