{"id":"CVE-2026-82039","published":"2026-10-02T20:17:04.430","lastModified":"2026-10-06T15:25:00.650","description":"UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16","tags":[]},{"url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","tags":[]},{"url":"https://www.vulncheck.com/advisories/utmstack-sql-injection-via-searchgroupsbyfilter","tags":[]}],"exploitRefs":[{"url":"https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16","tags":[]},{"url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows authenticated attackers to inject arbitrary SQL, enabling full database access and potential filesystem access, due to unsanitized input in the UTMStack asset management feature.","exploitability":"Exploitation is relatively straightforward for attackers who can authenticate and supply malicious input, requiring knowledge of the specific assetType and groupName values.","blast_radius":"If exploited, this could result in full database compromise, data theft, and potential filesystem access, affecting all users and systems interacting with the database.","remediation":"Upgrade to UTMStack 11.2.16 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sql-injection","web","database"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:54:35.682Z"}}