CVE-2026-108963GHSA-hm57-pvxc-4pcm
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result
David-Crty databasement
CVSS
8.8HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.69%Chance of exploitation activity in the next 30 days, higher than 76% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.8.2databasementCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
Text from CVE List
Affected versions 1
- databasementaffected: 1.0.0 before 1.8.2CVE List
References 5
- github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862cFixvia CVE List
- github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499Fixvia CVE List
- github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcmExploitvia CVE List
- github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22Referencevia CVE List
- github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3Referencevia CVE List