Bug 2555663 (CVE-2026-112307)
| Summary: | CVE-2026-112307 sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, anthomas, aos-team-art-private, asdas, brasmith, cmyers, cochase, dnakabaa, dpaolell, dranck, dschmidt, eglynn, ehelms, ggainey, ikhan, ilpinto, jdelft, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, jupierce, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lgarciaa, lhh, ltomasbo, mbiarnes, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, omaciel, osousa, pcreech, ppalepu, ppostler, prdhamdh, rbiba, rbobbitt, rchan, sghai, sidsharm, simaishi, smallamp, sskracic, stcannon, suppawar, tmalecek, tpfromme, ttakamiy, vlaad, yguenane, ykashtan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input containing embedded expressions, leading to arbitrary code execution when the generated PHP snippet is run.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.