PT-2026-43625 · Postgresql Global Development Group+1 · Postgresql+1

CVE-2026-8054 · Published 2026-05-27 · Updated 2026-06-27

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions dotCMS Core versions 25.11.04-1 through 26.04.28-02

Description Improper neutralization of special elements used in an SQL command allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The issue exists because the Publish Audit API endpoints "/api/auditPublishing/get" and "/api/auditPublishing/getAll" do not enforce authentication and accept unsanitized input used in dynamically constructed SQL.

Recommendations Update to version 26.04.28-03 or 26.05.06-01 and later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8054

Affected Products

Postgresql

Dotcms Core

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8054.json · Exploit
• https://github.com/dotCMS/core/pull/35553 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8054 · Security Note
• https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-8054 · Vendor Advisory
• https://github.com/dotCMS/core · Note
• https://twitter.com/autumn_good_35/status/2060036414902075457 · Twitter Post
• https://twitter.com/ethicalhack3r/status/2063995950503166061 · Twitter Post
• https://twitter.com/ethicalhack3r/status/2070884443544310176 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2064316625650909379 · Twitter Post
• https://twitter.com/pyn3rd/status/2064601779170578866 · Twitter Post