Argument injection in databasement allows remote code execution
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-88.
Summary
David-Crty databasement before 1.8.2 runs certain commands such as mariadb-dump with a database name that any authenticated user can set. The database name is passed as a command argument without neutralizing argument delimiters (CWE-88), so a user can inject options that write files to the server. An authenticated remote attacker with low privileges can use this to achieve remote code execution. A public exploit link is listed in the references, and the flaw is not in CISA KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| David-Crty | databasement | 1.0.0 to before 1.8.2 | 1.8.2 | Patch available | CNA |
- databasement VendorDavid-Crty Affected 1.0.0 to before 1.8.2 Fixed in 1.8.2 Patch available CNA
Remediation
Update David-Crty databasement to version 1.8.2, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA databasement (David-Crty) Fixed in 1.8.2
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108963
- 2026-10-11 Alias added: GHSA-7cxh-ppfp-4mq4
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → HIGH
References
Other 4
- https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22
- https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862c
- https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499
- https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3
More David-Crty vulnerabilities
- TI-2026-85050 Databasement OIDC login bypass lets attackers take over accounts CVSS 4.0CRITICAL 9.2
- TI-2026-65723 David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control CVSS 4.0MEDIUM 5.3
- TI-2026-76086 Missing authorization in David-Crty Databasement scheduled restore CVSS 4.0MEDIUM 5.1
- TI-2026-65722 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal CVSS 4.0LOW 2.1
- TI-2026-63662 Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token CVSS 4.0CRITICAL 9.1
Sources
- CVE-2026-108963 · CVE Program
- CVE-2026-108963 · NVD
- FIRST EPSS
- GHSA-7cxh-ppfp-4mq4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences