CVE-2025-3818 webpy web.py db.py PostgresDB._process_insert_query sql injection
Remote attackers can exploit SQL injection in web.py's PostgresDB insert query processing to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3818?
CVE-2025-3818 is a medium-severity SQL injection vulnerability in webpy web.py, published on 19 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-3818?
How do I fix CVE-2025-3818?
Apply the vendor's patch.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-3818 being exploited?
There is no known exploitation of CVE-2025-3818 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-3818, DLA-4189-1, GHSA-9g47-36rw-gjh2, UBUNTU-CVE-2025-3818, USN-8443-1.