CVE-2026-62362

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-62362

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62362.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-62362

Aliases

GHSA-pc89-mfwm-hj9x

Published

2026-10-16T16:43:52Z

Modified

2026-10-17T02:49:07Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint

Details

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62362.json"
}

References

Affected packages

Git / github.com/pbh-btn/peerbanhelper

Affected ranges

Type

GIT

Repo

https://github.com/pbh-btn/peerbanhelper

Events

Introduced

4c475b80c85c18ee80f175e43f0191c1d7922f99

Fixed

1585b086d63d987ba2ab181fd1eea8b4dd4bea93

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "9.3.15"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.1.0

v6.*

v6.0.2

v6.0.3

v6.0.4

v6.1.0

v6.1.1

v6.2.1

v6.2.4

v6.2.6

v6.2.7

v6.2.8

v6.3.0

v6.4.0

v6.4.1

v6.4.2

v6.4.6

v6.4.7.1

v7.*

v7.0.0

v7.0.1

v7.0.2

v7.1.0

v7.1.1

v7.1.2

v7.1.3

v7.1.5

v7.2.0

v7.2.1

v7.2.2

v7.3.0

v7.3.1

v7.3.2

v7.3.3

v7.4.0

v7.4.10

v7.4.12

v7.4.13

v7.4.14

v7.4.15

v7.4.2

v7.4.3

v7.4.5

v7.4.6

v7.4.8

v7.4.9

v8.*

v8.0.0

v8.0.1

v8.0.10

v8.0.11

v8.0.2

v8.0.3

v8.0.7

v8.0.8

v8.0.9

v9.*

v9.0.0

v9.0.1

v9.0.10

v9.0.2

v9.0.3

v9.0.4

v9.0.5

v9.0.7

v9.0.8

v9.0.9

v9.1.0

v9.1.1

v9.1.2

v9.1.3

v9.1.4

v9.1.5

v9.2.0

v9.2.1

v9.2.2

v9.2.3

v9.2.4

v9.2.5

v9.3.0

v9.3.1

v9.3.10

v9.3.11

v9.3.12

v9.3.13

v9.3.14

v9.3.2

v9.3.3

v9.3.4

v9.3.5

v9.3.6

v9.3.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62362.json"