Loading vulnerability…
SQL Injection in Raytha CMS OData Filter Parsing Pipeline
CVE-2026-12076 is a critical SQL injection vulnerability in Raytha CMS, confirmed in version 1.5.2. The flaw exists in the OData filter parsing pipeline, where insufficient neutralization of attacker-controlled input allows arbitrary SQL statements to be executed against the underlying PostgreSQL database. The issue is remotely exploitable over the network and does not require authentication or user interaction. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.5.2, but other versions may also be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary SQL statements on the backend PostgreSQL database. This can lead to full database compromise, including extraction of stored credentials, unauthorized access to sensitive data, modification or deletion of database contents, and potential service disruption depending on the executed statements. The available scoring context indicates high confidentiality, integrity, and availability impact.
If you can’t patch tonight, do this now.
If an official fix is not yet available, apply SQL injection mitigations around the vulnerable request path where possible, restrict database account privileges to the minimum necessary, and closely monitor PostgreSQL and application logs for suspicious queries or anomalous access patterns. Limit network exposure of the vulnerable application where feasible until remediation is available.
Patch, then assume compromise.
Upgrade Raytha CMS to a patched version when one becomes available. The provided content confirms the issue in version 1.5.2 but does not identify a fixed version. In addition, review and correct the OData filter parsing pipeline to ensure attacker-controlled input is safely parameterized and not incorporated into SQL queries in an unsafe manner. Validate affected deployments for compromise, especially database credential exposure or unauthorized SQL activity.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.