CVE-2026-108963

Summary

The databasement library before version 1.8.2 allows authenticated users to inject OS commands through database names, enabling remote code execution by writing arbitrary PHP files to the web root. This occurs because the mariadb-dump command doesn't properly quote user-supplied database names, allowing attackers to inject additional commands.

Exploitability

Exploitation requires an authenticated user account with access to the database management interface, but is relatively straightforward once achieved as it leverages existing database dump functionality to write PHP code directly to the web server's document root.

Blast radius

If exploited, attackers could execute arbitrary code on the web server, potentially leading to full system compromise, data exfiltration, or serving malicious content to other users.

Detection

Monitor for unusual file creation patterns in the web root directory, particularly PHP files being written by the web server process, and examine application logs for database dump operations with unexpected arguments.

Prioritized remediation

Upgrade to databasement version 1.8.2 or later to fix the OS command injection vulnerability in mariadb-dump functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.