DEBIAN-CVE-2026-72558

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-72558
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-72558.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-72558
Upstream
  • CVE-2026-72558
Published
2026-08-11T12:17:41Z
Modified
2026-08-27T23:06:21Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

References

Affected packages

Debian:11 / civicrm

Package

Name
civicrm
Purl
pkg:deb/debian/civicrm?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.33.2+dfsg1-1
5.50.1+dfsg1-1
5.50.3+dfsg1-1
5.52.2+dfsg1-1
5.53.0+dfsg1-1
5.68.1+dfsg1-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-72558.json"