Cyber Resilience

CVE-2025-45346

High

Published: 29 July 2025

Published
29 July 2025
Modified
06 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0052 67.3th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-45346 is a high-severity SQL Injection (CWE-89) vulnerability in Bacula Bacula-Web. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-45346 is a SQL injection vulnerability (CWE-89) affecting Bacula-web versions prior to 9.7.1. This flaw enables a remote attacker to execute arbitrary code through a specially crafted HTTP GET request. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

A remote attacker with network access can exploit this vulnerability without authentication or user interaction, though it requires high attack complexity. Successful exploitation allows arbitrary code execution on the affected system, potentially leading to full compromise of the Bacula-web instance.

Mitigation is available via the official patch in Bacula-web version 9.7.1, as detailed in the project's GitHub release at https://github.com/bacula-web/bacula-web/releases/tag/v9.7.1. The fixing commit is accessible at https://github.com/bacula-web/bacula-web/commit/ad5d94809f17994a61496ecfec9cd3a16ac14a5f. Security practitioners should prioritize upgrading affected deployments to this version.

EU & UK References

Vulnerability details

SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote unauthenticated RCE via crafted request to public-facing web application matches T1190 exactly.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

bacula
bacula-web
≤ 9.7.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Information input validation directly prevents SQL injection by sanitizing and validating crafted HTTP GET parameters before database queries.

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires timely patching to Bacula-web v9.7.1, which fixes the specific SQL injection vulnerability.

SC-7 Boundary Protection partial match
prevent

Boundary protection with web application firewalls inspects and blocks remote HTTP requests containing SQL injection payloads.

References