CVE-2025-1520HIGH 8.0EPSS p34.4%

CVE-2025-1520CVE-2025-1520

Description

PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the SQL parser. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the database account. Was ZDI-CAN-25350.

Scoring

CVSS 3.18.0 (HIGH)
VectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.43% probability of exploitation · percentile 34.4% · 2026-06-19T12:03:05Z
Published2025-04-23
Last modified2025-08-07

Underlying weaknesses· 1

CWE-89

References

  1. https://github.com/PostHog/posthog/commit/6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42
  2. https://www.zerodayinitiative.com/advisories/ZDI-25-099/

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')cwe-890%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-1094
CVE
CVE-2026-2004
CVE
CVE-2025-12819
CVE
CVE-2025-2945
CVE
CVE-2026-2006
CVE
CVE-2026-2005
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.