CVE-2025-25206: Elabftw Information Disclosure Vulnerability

CVE-2025-25206 Overview

CVE-2025-25206 affects eLabFTW, an open source electronic lab notebook used by research laboratories. Versions prior to 5.1.15 contain an improper input validation flaw classified under CWE-89 (SQL Injection). An authenticated user can leverage the flaw to read sensitive information stored in the database, including login tokens. When cookies are enabled, which is the default configuration, the disclosed token material enables privilege escalation. The eLabFTW maintainers addressed the issue in release 5.1.15, and no workarounds are available.

Critical Impact

Authenticated attackers can extract login tokens and database content, escalating privileges within the eLabFTW instance and gaining access to research data.

Affected Products

• eLabFTW versions prior to 5.1.15
• Default deployments with cookie-based authentication enabled
• Self-hosted research lab notebook instances using the affected elabftw package

Discovery Timeline

• 2025-02-14 - CVE-2025-25206 published to NVD
• 2025-02-14 - Vendor security advisory GHSA-qffc-rfjh-77gg released alongside fix in eLabFTW 5.1.15
• 2025-08-18 - Last updated in NVD database

Technical Details for CVE-2025-25206

Vulnerability Analysis

The vulnerability is rooted in improper input validation that maps to CWE-89, the SQL Injection weakness class. An authenticated user supplies crafted input to an eLabFTW endpoint that does not adequately validate or parameterize the value before it reaches the database query layer. The attacker reads arbitrary content from the underlying database, including authentication tokens persisted for session management.

Because eLabFTW enables cookie-based authentication by default, the leaked token material can be replayed by the attacker. Replaying a higher-privileged user's token grants that user's permissions, completing a privilege escalation chain from a low-privileged authenticated account to administrator-level access.

Root Cause

The root cause is missing or insufficient input sanitization on a user-controlled parameter consumed by a database query. The application accepts authenticated input and concatenates or interprets it in a way that allows controlled SQL semantics. See the GitHub Security Advisory GHSA-qffc-rfjh-77gg for the maintainer's description.

Attack Vector

The attack vector is network-based and requires a valid authenticated session. The attacker sends crafted requests to an eLabFTW endpoint and observes responses that disclose database content. After harvesting a token, the attacker sets it as a cookie and issues subsequent requests under the elevated identity. No user interaction is required beyond the attacker's own authenticated session.

No public proof-of-concept exploit has been published. Technical details are documented in the maintainer's security advisory.

Detection Methods for CVE-2025-25206

Indicators of Compromise

• Unexpected database errors or anomalous response sizes returned to authenticated eLabFTW endpoints.
• HTTP request parameters containing SQL meta-characters such as single quotes, UNION, SELECT, or comment sequences originating from low-privileged accounts.
• Session activity where a user account suddenly authenticates with a cookie or token that belongs to a different, higher-privileged user.
• Access to administrative routes by accounts that have no historical pattern of administrative use.

Detection Strategies

• Inspect eLabFTW web server and application logs for authenticated requests containing SQL syntax artifacts or unusually long parameter values.
• Correlate token issuance events with subsequent token usage from different source IP addresses or user agents to detect replay.
• Alert on privilege boundary crossings, such as a standard user account performing administrator-only actions within a short timeframe.

Monitoring Recommendations

• Forward eLabFTW application, web server, and database query logs to a centralized analytics platform for retention and correlation.
• Monitor the running version of eLabFTW across all hosted instances and alert when any instance reports a version earlier than 5.1.15.
• Track database query latency and error rates as a secondary signal of injection probing.

How to Mitigate CVE-2025-25206

Immediate Actions Required

• Upgrade eLabFTW to version 5.1.15 or later using the official 5.1.15 release.
• Rotate all user authentication tokens and force re-authentication after upgrading, since pre-patch tokens may have been disclosed.
• Audit account activity and administrative actions performed before the upgrade for signs of unauthorized privilege escalation.
• Review database contents for unauthorized reads where audit logging is available.

Patch Information

The eLabFTW maintainers fixed the issue in version 5.1.15. The patch is documented in the GitHub Security Advisory GHSA-qffc-rfjh-77gg and shipped in the 5.1.15 release. The vendor states that no workarounds exist, making the upgrade mandatory.

Workarounds

• No vendor-supplied workarounds are available; upgrading to 5.1.15 is required.
• As a temporary risk reduction measure, restrict eLabFTW access to trusted networks via firewall or reverse proxy rules until the upgrade is applied.
• Reduce the number of authenticated accounts and disable unused accounts to limit the pool of users who could exploit the flaw.

# Verify the installed eLabFTW version meets or exceeds the fixed release
docker exec -it elabftw cat /elabftw/src/classes/Update.php | grep -i 'REQUIRED_SCHEMA\|version'

# Pull and deploy the patched container image
docker pull elabftw/elabimg:5.1.15
docker compose down
docker compose up -d