CVE-2026-21856

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-21856

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21856.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-21856

Aliases

GHSA-4gcx-ghwc-rc78

Published

2026-01-07T18:18:22Z

Modified

2026-09-07T03:30:33Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Tarkov Data Manager has Authenticated SQL Injection

Details

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based blind SQL injection vulnerability in the webhook edit and scanner api endpoints that allow an authenticated attacker to execute arbitrary SQL queries against the MySQL database. Commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 contains a patch.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21856.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "2.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/the-hideout/tarkov-data-manager

Affected ranges

Type

GIT

Repo

https://github.com/the-hideout/tarkov-data-manager

Events

Introduced

Fixed

9bdb3a75a98a7047b6d70144eb1da1655d6992a8

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21856.json"