Critical SQL Injection in Raytha CMS Exposes PostgreSQL Databases
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jun 30, 2026
A critical SQL injection flaw tracked as CVE-2026-12076 has been disclosed in Raytha CMS, with confirmed impact on version 1.5.2. The vulnerability resides in the platform’s OData filter parsing pipeline and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying PostgreSQL database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data.
The issue has been rated CVSS 4.0 9.3 (Critical) and is considered remotely exploitable. CERT Polska coordinated disclosure and credited Arkadiusz Marta for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
