CVE-2025-8264: Z-Push SQL Injection in IMAP Backend Username Handling

Z-Push is an open source ActiveSync server. When the IMAP backend is set to look up a sender's From address with IMAP_FROM_SQL_QUERY, it builds that SQL query from the username in the Basic Authentication header without parameterizing it.

An unauthenticated attacker puts SQL in the username and runs it against the linked database. That reads, changes or deletes data in whatever database the query points at. Z-Push 2.7.6 fixes the issue. Setting IMAP_DEFAULTFROM to the default or to ldap removes the vulnerable path.