CVE-2025-26845 is an eval injection in Znuny through version 7.1.3, scored Critical (CVSS 9.8) in the record. Someone with write access to the configuration file can run a command as the user who runs backup.pl. Check advisory ZSA-2025-03 for the fixed release.
What's affected
The record says Znuny through 7.1.3. The Znuny advisory ZSA-2025-03, dated 2025-02-12, lists these affected lines: all Znuny LTS versions from 6.5.1 up to and including 6.5.11, all Znuny versions from 7.0.1 up to and including 7.1.3, and all Znuny LTS 6.0 versions.
The advisory page I read does not name a fixed version, so confirm the patched release on the Znuny site before you plan the upgrade.
One thing to note: the advisory rates the issue as low severity, because the attacker needs local write access to the configuration. The CVSS 9.8 in the record reflects the base metrics for the weakness and does not weigh that precondition the same way. Both views are useful, and your own risk depends on who can write to the Znuny configuration on your servers.
How to check if you're exposed
First find out which Znuny version you run. The version appears in the admin interface, and on the server you can ask the installation:
grep -ri "version" /opt/znuny/RELEASE 2>/dev/null
The install path may differ in your setup. Then answer the question that matters for this CVE: who and what can write to the configuration files, and which account runs the backup script.
ls -l /opt/znuny/Kernel/Config.pm 2>/dev/null
ls -ld /opt/znuny/Kernel/Config 2>/dev/null
crontab -l -u root 2>/dev/null | grep -i backup
If the backup runs as root, or any account that is more privileged than the people who can edit the config, you have the privilege escalation path the advisory describes. If the backup runs as the same limited account that owns the config, the gap is smaller.
What to do now
- Identify every Znuny instance and its version, including LTS 6.0 and 6.5 installs.
- Read advisory ZSA-2025-03 and confirm the fixed release for your branch.
- Upgrade to the fixed release as soon as you can test it.
- Until then, restrict write access to the Znuny configuration to the smallest set of administrators.
- Run backup.pl from a dedicated low privilege account where possible, and not as root.
- Audit recent changes to the configuration files and check backup jobs for unexpected behaviour.
Why it matters
The record lists CWE-94 and CWE-95. Eval injection means that data is passed to a function that runs it as code. If an attacker can influence the string, they influence what the program executes.
The risk here is a chain, not a single flaw. A person who can already change the configuration is not fully trusted to run commands as the backup account, but the eval step gives them that power. This is a classic way for a limited foothold to grow into full control of a server when a scheduled job runs with higher rights than the files it reads. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
The practical lesson is to treat configuration files as code when anything evaluates them, and to run scheduled jobs with the least privilege that works.
Quick check
Why is the CVSS Critical when the advisory says low?
The record's base score is 9.8, while the Znuny advisory rates severity low because the attacker needs local write access to the configuration. Use both: the weakness is serious, and the precondition limits who can reach it.
Is there a fixed version?
The advisory page I read does not name one. Check the Znuny advisory page and release notes for your branch before upgrading.
Sources
Last reviewed: 19 October 2026.
