SQL Injection in Cern-Fts Fts-Monitoring
CVE-2025-71458
FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.
Vulnerability class: SQL Injection
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- EGI SVG Advisory EGI-SVG-2025-09 (third-party-advisory)
- github.com/cern-fts/fts-monitoring (product)
- Vulnerable get_linkinfo at v3.14.0 (technical-description)
- Backport Commit (3.13.3) (patch)
- Patch Commit (patch)
- fts-monitoring v3.13.3 Release Notes (release-notes)
- fts-monitoring v3.14.1 Release Notes (release-notes)
- VulnCheck Advisory: FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo (third-party-advisory)
Frequently asked questions
- What is CVE-2025-71458?
- CVE-2025-71458 is a high-severity vulnerability in Cern-Fts Fts-Monitoring, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-11-06.
- How severe is CVE-2025-71458?
- High severity. CVSS v3 base score is 7.5 out of 10.