PT-2026-34610 · Nocobase · @Nocobase/Plugin-Collection-Sql
P80N-Sec
·
Published
2026-04-22
·
Updated
2026-05-07
·
CVE-2026-41641
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
@nocobase/plugin-collection-sql versions prior to 2.0.39
Description
An issue exists where the
checkSQL() validation function, designed to block dangerous SQL keywords such as pg read file, LOAD FILE, and dblink, is not applied to the 'sqlCollection:update' endpoint. While this validation is active for 'collections:create' and 'sqlCollection:execute', its absence in the update process allows an attacker with collection management permissions to bypass security checks. By creating a collection with benign SQL and subsequently updating it with arbitrary SQL, an attacker can execute unauthorized queries to exfiltrate sensitive data, read arbitrary files from the database server filesystem, or perform lateral movement to other databases.Recommendations
Update @nocobase/plugin-collection-sql to version 2.0.39 or later.
As a temporary workaround, restrict access to the 'sqlCollection:update' endpoint to minimize the risk of exploitation.
Exploit
Fix
Improper Access Control
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Nocobase/Plugin-Collection-Sql