---
id: CVE-2025-71458
title: >-
  FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via
  /linkinfo
summary: >-
  FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0
  contain an unauthenticated sql injection vulnerability in the /linkinfo
  endpoint handled by get_linkinfo. Remote attackers can inject SQL through the
  source_s…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: cern-fts
product: fts-monitoring
affected:
  - fts-monitoring >= 3.12.0 < 3.13.3
  - fts-monitoring >= 3.14.0 < 3.14.1
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T00:20:23.644Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71458'
references:
  - url: 'https://advisories.egi.eu/Advisory-EGI-SVG-2025-09'
    label: EGI SVG Advisory EGI-SVG-2025-09
  - url: >-
      https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596
    label: Patch Commit
  - url: >-
      https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08
    label: Backport Commit (3.13.3)
  - url: >-
      https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60
    label: Vulnerable get_linkinfo at v3.14.0
  - url: 'https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1'
    label: fts-monitoring v3.14.1 Release Notes
  - url: 'https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3'
    label: fts-monitoring v3.13.3 Release Notes
  - url: 'https://github.com/cern-fts/fts-monitoring'
  - url: >-
      https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo
    label: >-
      VulnCheck Advisory: FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0
      SQL Injection via /linkinfo
tags:
  - cve.org
ingestedAt: '2026-11-06T00:42:24.725Z'
epss: 0.00395
epssPercentile: 0.33979
---

## Overview

FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.

## Affected

- `fts-monitoring >= 3.12.0 < 3.13.3`
- `fts-monitoring >= 3.14.0 < 3.14.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.