CVE-2025-25222 is a critical (CVSS 9.8) SQL injection flaw in retrieve.php of the LuxCal Web Calendar. The MySQL edition before 5.3.3M and the SQLite edition before 5.3.3L are affected. A remote caller may read, change or delete database content. Update to the developer's latest release.
What's affected
- Product: LuxCal Web Calendar by LuxSoft, a self-hosted PHP calendar.
- Affected: the MySQL version prior to 5.3.3M and the SQLite version prior to 5.3.3L.
- Fixed: JVN's advisory points to LuxCal 5.3.3, released 24 December 2024, in the MySQL and SQLite editions, and says to update to the latest version the developer provides. Confirm the build letter matches your database type.
- Affected file:
retrieve.php. - Impact: JVN states that information in the database may be deleted, altered or retrieved.
- Related: JVN#26024080 covers four CVEs in total. This post covers CVE-2025-25222. CVE-2025-25221 is the sibling flaw in pdf.php.
How to check if you're exposed
Find your LuxCal version in the calendar's admin or about page, or in the footer of the pages it renders. The version string ends in a letter that tells you the edition: M for MySQL and L for SQLite.
If you cannot see it in the interface, look at the files on the server.
grep -rn "5\.3\." --include=*.php <path-to-luxcal> | head
ls -l <path-to-luxcal>/retrieve.php
Any build older than 5.3.3M (MySQL) or 5.3.3L (SQLite) is affected. Then check your web server logs for requests to the retrieve.php file, especially from addresses you do not recognise.
grep "retrieve.php" /var/log/nginx/access.log | less
Unusual query strings, long values or bursts of requests from one address warrant a closer look at the database for changed or missing rows.
What to do now
- Download the current LuxCal release from the LuxSoft site and update, using the build that matches your database type.
- Back up the files and the database before you update so you can compare if anything looks off.
- Restrict the calendar to the users who need it, or put it behind a login at the web server or a VPN, until you have updated.
- Check the database for rows or accounts you did not create, and for data that has gone missing.
- Rotate the database credentials stored in the calendar's configuration if you saw suspicious traffic.
- Add the calendar to your software inventory so that future advisories reach someone.
Why it matters
The class is SQL injection. A value from the request becomes part of a database query without being kept separate from the query's structure, so the database cannot tell the developer's text from the caller's. The affected endpoint here is retrieve.php.
- CWE-89 is improper neutralization of special elements in an SQL command. Input that should be treated as data ends up inside the query text, so the database cannot tell the application's query from the caller's input.
Calendars are easy to forget. They hold names, events and sometimes login data, and teams often install them once and never touch them again. An unauthenticated SQL injection exposes whatever the database user can reach, and the record's score reflects the full range of read, change and delete. The durable fix on the code side is parameterised queries, which the vendor's update addresses. On your side, the lesson is to keep a list of the self-hosted PHP apps you run and a way to hear about their advisories.
Quick check
How do I know which edition I run?
The build letter shows it. The M edition uses MySQL and the L edition uses SQLite, and the fixed release is 5.3.3M or 5.3.3L accordingly.
Does updating fix other LuxCal CVEs too?
JVN#26024080 lists four CVEs in the same release notice, and recommends updating to the latest release. Read the advisory for the full list.
Sources
Last reviewed: 19 October 2026.
