CVE-2025-66944 is a critical SQL injection (CVSS 9.8) in Databasir, the open source database documentation tool, versions 1.0.7 and before. A remote attacker can abuse the query parameter of the search API endpoint. The record names no fixed version, so check the project issue before relying on a patch.
What's affected
- Databasir (vran-dev/databasir) 1.0.7 and before.
- Affected component: the query parameter of the search API endpoint.
- Fixed version: not stated in the record. Check the linked project issue and the repository releases.
How to check if you're exposed
Find the Databasir version on your server. If you run the jar or container, the version is in the file name or image tag. Anything at 1.0.7 or lower is in scope.
Then check who can reach the service. Databasir usually documents internal schemas, so it often sits on an internal network. Test from a segment that should not have access to confirm that it does not.
What to do now
- Find every Databasir deployment.
- Read the project issue 283 and the repository releases to see whether a fixed version exists.
- Restrict access to the service to the people who use it, through a VPN or an allow list at the proxy.
- Run the database account used by Databasir with the least privileges it needs.
- Review the schema metadata held in Databasir, since a read of it shows how your databases are laid out.
- If no fix appears, consider replacing the tool.
Internal documentation tools tend to be forgotten once set up. Add Databasir to your asset list with an owner, and check whether its database account can touch anything beyond its own schema. If the answer is yes, narrow it now, whichever way the patch question resolves.
Why it matters
The weakness is CWE-89, SQL injection. The search value is placed into a database query as part of the command, so special characters change the query. The standard remedy is parameterized queries, which keep the value as data.
The CVE text says the flaw allows arbitrary code execution, while the weakness named is SQL injection. How far an injection goes depends on the database and its privileges, so read the claim with care and assume at least full read access to the tool's database.
The record does not list this CVE as exploited in the wild.
Quick check
Is there a patched Databasir version for CVE-2025-66944?
The record does not name one. Check the project issue and releases, and limit network access in the meantime.
Sources
Last reviewed: 19 October 2026.
