Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM', ''); or php define('IMAP_DEFAULTFROM', 'ldap');

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to     unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the     username field in basic authentication. This allows the attacker to access and potentially modify or     delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push     installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation     Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM',     ''); or php define('IMAP_DEFAULTFROM', 'ldap'); (CVE-2025-8264)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to
    unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the
    username field in basic authentication. This allows the attacker to access and potentially modify or
    delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push
    installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. Mitigation
    Change configuration to use the default or LDAP in backend/imap/config.php php define('IMAP_DEFAULTFROM',
    ''); or php define('IMAP_DEFAULTFROM', 'ldap'); (CVE-2025-8264)

ID	Name	Product	Family	Severity
251256	Linux Distros Unpatched Vulnerability : CVE-2025-8264	Nessus	Misc.	critical
428676	SCA: security update for z-push/z-push-dev (GHSA-w832-w3p8-cw29)	Tenable Cloud Security	SCA Checks	critical
428676	SCA: security update for z-push/z-push-dev (GHSA-w832-w3p8-cw29)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-8264

critical

Tenable Plugins

critical

critical

critical