{"schema":"threatline.record/2","record":{"id":"CVE-2026-108963","aliases":["GHSA-hm57-pvxc-4pcm"],"summary":"databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result","details":"databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.","categories":["Unclassified"],"product":"databasement","vendor":"David-Crty","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108963","source_modified_at":"2026-10-13T13:55:14.493Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"databasement","vendor":"David-Crty","versions":[{"lessThan":"1.8.2","status":"affected","version":"1.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108963","source_modified_at":"2026-10-13T13:55:14.493Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"databasement","ecosystem":null},"version":"1.8.2","basis":"first unaffected version stated in the CVE record"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.01685,"percentile":0.76842,"score_date":"2026-10-23"},"published_at":"2026-10-11T19:38:44.171Z","modified_at":"2026-10-13T13:55:14.493Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108963","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T13:55:14.493Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108963","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm","tags":["vendor-advisory","exploit","technical-description"]},{"source":"CVE List","url":"https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22","tags":["product"]},{"source":"CVE List","url":"https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862c"},{"source":"CVE List","url":"https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499"},{"source":"CVE List","url":"https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3","tags":["not-applicable"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-13T13:54:57.257252Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T13:55:14.493Z","content_hash":"5ca861ff63e6665c9955f036a01bc5a373e71c7775450a9aa909edc9097f6518"}}