PT-2026-46872 · Packagist · Billabear/Billabear

Published 2026-05-19 · Updated 2026-05-19

OSV

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE ACCOUNT MANAGER permissions can exploit this to execute arbitrary SQL commands.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-XP6R-8PCC-XV5P

Affected Products

Billabear/Billabear

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31069 · Security Note
• https://osv.dev/vulnerability/GHSA-xp6r-8pcc-xv5p · Vendor Advisory
• https://github.com/billabear/billabear · Note
• https://gist.github.com/nedlir/a50725b94650467f0593b8f4009ae19e · Note
• https://gist.github.com/nedlir/2377ba6e7fa2ad957210b52aa8e400d9 · Note