Back to Database
Status published
Critical
CVE-2025-21628
Chatwoot has a Blind SQL-injection in Conversation and Contacts filters
Vulnerability Description
Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-21628
Credits & Attribution
No credits recorded in the NVD database.
References
More from chatwoot
View All →CVE-2024-0640
Stored XSS in chatwoot/chatwoot
Medium
5.6
CVE-2023-2109
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
Medium
5.3
CVE-2022-3741
Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
Critical
9.4
CVE-2022-2901
Improper Authorization in chatwoot/chatwoot
High
7.6
CVE-2022-1022
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
High
8.1
Affected Vendor
chatwoot
View all reports →Affected Software
chatwoot
Vulnerable Versions:
>= 2.16.1, < 3.16.0
Timeline
Official Publish:
January 9th, 2025
Last Modified:
January 9th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L