Unauthenticated SQL Injection in dotCMS Publish Audit API
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-8054. PoCs published by Mr-xn. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository provides a Docker-based environment to exploit CVE-2026-8054 in dotCMS 25.11.04-1, likely involving JNDI injection or database misconfiguration. The setup includes PostgreSQL and Elasticsearch dependencies, with scripts to configure the vulnerable environment.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
Exploits (1)
This repository provides a Docker-based environment to exploit CVE-2026-8054 in dotCMS 25.11.04-1, likely involving JNDI injection or database misconfiguration. The setup includes PostgreSQL and Elasticsearch dependencies, with scripts to configure the vulnerable environment.
Nuclei Templates (1)
http.title:"dotcms"
title="dotcms"
References (2)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X