Bug 2567911 (CVE-2026-113370) - CVE-2026-113370 nexus: nexus: Database modification via SQL injection in reindex task
Summary: CVE-2026-113370 nexus: nexus: Database modification via SQL injection in rein...
Keywords:
Status: NEW
Alias: CVE-2026-113370
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-05 22:35 UTC by OSIDB Bzimport
Modified: 2026-11-06 02:31 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-05 22:35:44 UTC 
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
Note You need to log in before you can comment on or make changes to this bug.