Read the docs
TI-2026-29105 Aliases CVE-2026-40330

Masa CMS SQL injection via sortDirection parameter in beanFeed

Priority MEDIUM 48CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, use a WAF to block or restrict access to the beanFeed.cfc component, or deploy rules to detect SQL injection patterns targeting the sortDirection parameter.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MasaCMSMasaCMSup to 7.2.9; 7.3.0 – 7.3.14; 7.4.0 – 7.4.9; 7.5.0 – 7.5.2—No fix listedCNA
  • MasaCMS VendorMasaCMS Affected up to 7.2.9; 7.3.0 – 7.3.14; 7.4.0 – 7.4.9; 7.5.0 – 7.5.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*——MasaCMS
  • cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* Versions — — ·MasaCMS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40330
  2. 2026-10-09 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 1

  • TI-2024-21522 MasaCMS SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-21523 Masa CMS Vulnerable to Pre-Auth RCE via JSON API CVSS 3.1CRITICAL 9.8
  • TI-2024-21524 Host header poisoning allows account takeover via password reset email CVSS 3.1HIGH 8.8
  • TI-2024-21525 Masa CMS vulnerable to authentication bypass with /tag/ CVSS 3.1HIGH 7.5
  • TI-2022-23274 A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows… CVSS 3.1CRITICAL 9.8
  • TI-2026-29106 Masa CMS unauthenticated SQL injection via altTable parameter in JSON API CVSS 4.0CRITICAL 9.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences