CVE-2025-1520
CVSS 3.0 Score 7.1 of 10 (high)
Details
Published Apr 23, 2025
Updated: Apr 29, 2025
CWE ID 89
Summary
CVE-2025-1520 is a SQL Injection vulnerability affecting PostHog's ClickHouse Table Functions. This issue enables network-adjacent attackers to execute arbitrary code on susceptible installations of PostHog, requiring authentication to exploit it. The root cause lies in the SQL parser's lack of proper validation of user-supplied strings, which can be manipulated to construct malicious SQL queries and ultimately execute code in the context of the database account. (ZDI-CAN-25350)
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.