PT-2026-46872 · Packagist · Billabear/Billabear

Publicado 2026-05-19 · Atualizado 2026-05-19

OSV

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE ACCOUNT MANAGER permissions can exploit this to execute arbitrary SQL commands.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

GHSA-XP6R-8PCC-XV5P

Produtos afetados

Billabear/Billabear

Referências · 5

• https://github.com/billabear/billabear · Nota
• https://gist.github.com/nedlir/a50725b94650467f0593b8f4009ae19e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-31069 · Nota de Segurança
• https://gist.github.com/nedlir/2377ba6e7fa2ad957210b52aa8e400d9 · Nota
• https://osv.dev/vulnerability/GHSA-xp6r-8pcc-xv5p · Aviso do Fabricante