An SQL Injection flaw exists in the remote-sessions component of Devolutions Server, allowing an attacker to inject arbitrary SQL statements into queries that are executed against the server’s database. Classified as CWE-89, this vulnerability can lead to exposure or alteration of sensitive data stored on the server and may compromise the integrity of the database if user input is not properly sanitized. The impact is a significant risk to confidentiality and integrity, potentially allowing a malicious actor to exfiltrate data, modify records, or disrupt application functionality. The CVSS score of 9.8 reflects a severe risk, but the EPSS score of less than 1% indicates that exploitation probability is currently very low.

Devolutions Server version 2025.3.1 through 2025.3.12 are affected.

The vulnerability can be exploited remotely via the remote‑sessions interface, requiring network access and valid authentication to submit malicious input. It is listed as a high‑severity weakness; however, its EPSS score indicates that exploitation is unlikely at present, and it is not catalogued in CISA KEV. Despite the low exploitation probability, the potential damage is substantial if an attacker successfully injects SQL commands.