CVE-2026-105845

9.8 CRITICALpublic exploit available

Published 2026-10-06 · Updated 2026-10-06

AI risk analysis

Summary: The flaw allows untrusted users to perform SQL injection attacks by submitting crafted requests through dynamic filters or joins, leading to potential data compromise, integrity issues, and system availability problems.
Exploitability: Exploitation is relatively straightforward for an attacker who can query readable collections, as no specific technical skills beyond basic SQL knowledge are required.
Blast radius: If exploited, the impact could be severe, potentially leading to data theft, system compromise, and service disruption for users of the affected versions.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 3.88.0 or 4.0.0-canary.27 or later.

rcesql-injectionwebcontent-management

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.