Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

databasement before 1.8.2 lets authenticated users run code

CVE-2026-108963 · published 7 days ago
Summary

The databasement library versions earlier than 1.8.2 let any logged‑in user specify a database name that is passed to system commands such as mariadb‑dump. This can be abused to write files to the web root and execute arbitrary code on the server. Upgrade to version 1.8.2 or later, or restrict who can use the affected feature, to stop the risk.

What to do
  • Update david-crty databasement to version 1.8.2 or later.
Affected software
VendorProductAffected versions
david-crty databasement < 1.8.2
Original advisory text
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --res...
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Sources
CVE-2026-108963 · NVD
CVE-2026-108963 · MITRE
CVE-2026-108963 · OSV
GHSA-hm57-pvxc-4pcm · GHSA
Track software like this
Free during beta