CVE-2025-71458
FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.
| CWE | CWE-89 |
| Vendor | cern-fts |
| Product | fts-monitoring |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for cern-fts fts-monitoring
Be the first to know when new high vulnerabilities affecting cern-fts fts-monitoring are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
cern-fts / fts-monitoring
3.12.0 < 3.13.3 3.14.0 < 3.14.1
References
advisories.egi.eu: https://advisories.egi.eu/Advisory-EGI-SVG-2025-09 github.com: https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596 github.com: https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08 github.com: https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60 github.com: https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1 github.com: https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3 github.com: https://github.com/cern-fts/fts-monitoring vulncheck.com: https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo
Credits
Pau Cutrina