CVE-2026-8054

Executive Summary

CVE-2026-8054 is a critical (CVSS 10.0) unauthenticated SQL injection vulnerability residing in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) of dotCMS Core versions 25.11.04-1 through 26.04.28-02. The affected API endpoints fail to enforce authentication and pass unsanitized user-supplied input directly into dynamically constructed SQL queries. A remote, unauthenticated attacker can exploit this to read, modify, or destroy arbitrary database content, including credentials, content entries, and administrative hashes, leading to full system compromise in a typical enterprise deployment context. The vendor's fix, applied in version 26.04.28-03, now requires an authenticated backend user with the publishing-queue portlet permission; LTS releases remain unaffected.

Technical Analysis

Vulnerability Mechanism (CWE-89): The root cause lies in the Publish Audit API endpoints. Specifically, both GET /api/auditPublishing/get and GET /api/auditPublishing/getAll accept parameters (such as identifier, publishDate, or filter criteria) without applying parameterized queries or stored procedures. The unsanitized input is concatenated into a dynamic SQL string, which is then executed against the dotCMS database (typically PostgreSQL or MySQL). The classic boolean-based or time-based blind SQL injection techniques are applicable because error suppression appears to be absent, allowing inference of database schema via response timing deltas.

Authentication Bypass: The CNA title explicitly notes "Unauthenticated SQL Injection." The API endpoints in the affected versions do not invoke dotCMS's authentication interceptor or require a jwt token or session cookie. This effectively makes the vulnerability remotely exploitable without any prior knowledge or valid credentials.

Attack Surface: The API is exposed via Apache Tomcat or a reverse proxy configured for dotCMS. The vulnerable paths are:

• /api/auditPublishing/get?identifier=' UNION SELECT...--
• /api/auditPublishing/getAll?limit=1;SELECT pg_sleep(5);--

Code-Level Insight: Based on the pattern described in the advisory, the vulnerable code likely resembles:

String query = "SELECT * FROM publishing_queue WHERE identifier = '" + request.getParameter("identifier") + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Parameterized PreparedStatement usage, which is standard in dotCMS's other APIs, is bypassed in this endpoint path.

Affected Components: The OSV package reference (/ with unfixed marker) indicates that the vulnerability occurs in the core codebase, not a third-party library. The patch modifies the security check layers, adding RequireAuthentication and permission checks.

Exploitation Scenarios

Scenario 1: Database Content Exfiltration (Blind Boolean-Based)

1. Reconnaissance: An attacker scans the internet for dotCMS instances using Shodan dorks, identifying exposed /api/auditPublishing/get endpoints.
2. Verification: Send a baseline request to measure response times:

   GET /api/auditPublishing/get?identifier=1 HTTP/1.1
   Host: target.com
   

3. Injection: Craft a payload to test Boolean-based blind extraction of the database version:

   GET /api/auditPublishing/get?identifier=1' AND SUBSTRING((SELECT version()),1,1)='P'-- HTTP/1.1
   

4. Data Dump: Automate extraction of user_password and user_email tables using a tool like sqlmap with the --technique=B flag. Given the unauthenticated API response, sqlmap can automate full table dumps quickly.

Scenario 2: Full Database Compromise via Time-Based Injection

1. Time Inference: Use PostgreSQL pg_sleep() to confirm blind injection:

   GET /api/auditPublishing/getAll?limit=1;SELECT pg_sleep(10);-- HTTP/1.1
   

   A 10-second response delay confirms execution.
2. Write Access: Utilize stacked queries (if the DB is MySQL) or PostgreSQL COPY TO PROGRAM (if the database user has SUPERUSER role) to write a webshell into the dotCMS webroot (/srv/dotserver/webroot), achieving command execution.
3. Persistence: Alternatively, directly update the user table to replace the admin's password hash with one the attacker controls, then log into the dotCMS admin console.

Nuclei Template Status: A Nuclei template is publicly available, lowering the skill bar for exploitation. With a tool like Nuclei, continuous scanning of the internet/enterprise surface for this CVE is trivial.

Impact Assessment

CVSS Subscores:

• Attack Vector / Complexity: Network / Low.
• Privileges Required / User Interaction: None / None.
• Confidentiality / Integrity / Availability Impact: All High.
• Scope: Changed (S:C) — the DB is separate from the web server security context, potentially allowing pivot.

Business Impact:

• Data Breach: Arbitrary disclosure of content, user credentials, and database backend information.
• System Takeover: Modification of content (website defacement) or destruction of the database leads to denial-of-service for the CMS.
• Downstream Compromise: Many dotCMS deployments are for marketing sites and corporate intranets; valid DB credentials like admin hashes can be cracked and reused across the internal network.

Affected Systems:

• Self-hosted dotCMS installations on Tomcat.
• Docker and Kubernetes deployments of dotCMS/dotcms images.
• Managed environments relying on dotCMS Core reports.

Blast Radius: The database is the heart of the CMS; an exploit compromises all content, users, and related integrations (LDAP sync, SSO providers). The unauthenticated nature means an attacker does not need credentials from the OS or the web app.

Detection Guidance

Sigma Rule

title: Unauthenticated SQL Injection Attempt on dotCMS Audit API
id: 1c6f6d18-9a3b-4e5f-8c92-3b7a4d5e6f70
status: experimental
description: Detects SQL injection patterns in URLs targeting dotCMS audit publishing endpoints.
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-uri-stem|startswith:
      - '/api/auditPublishing/getAll'
      - '/api/auditPublishing/get'
    cs-uri-query|contains:
      - "'"
      - '%27'
      - 'UNION SELECT'
      - 'sleep('
      - 'pg_sleep'
      - 'WAITFOR DELAY'
  filter_known_good:
    cs-uri-query|contains:
      - 'identifier=123456'
  condition: selection and not filter_known_good
level: high
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Applications including a legitimate apostrophe in the identifier param without proper encoding.
  - Penetration testing by internal security teams.
tags:
  - attack.t1190
  - cve.2026.8054
  - cwe.89

YARA Rule

rule dotcms_auditapi_sqli_2026_8054
{
    meta:
        author = "Valterit SOC"
        description = "Detects SQL injection payloads in HTTP request bodies or logs targeting dotCMS Publish Audit API"
        reference = "CVE-2026-8054"
        date = "2024-05-28"
        severity = "critical"
        cve = "2026-8054"
    strings:
        $a1 = "/api/auditPublishing/get" ascii nocase
        $a2 = "/api/auditPublishing/getAll" ascii nocase
        $sqli1 = "UNION SELECT" ascii nocase
        $sqli2 = "pg_sleep" ascii nocase
        $sqli3 = "WAITFOR DELAY" ascii nocase
        $sqli4 = "' OR '1'='1" ascii nocase
        $sqli5 = "information_schema" ascii nocase
    condition:
        (uint16(0) == 0x3c3f or filesize < 100KB) and any of ($a*) and 2 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT dotCMS Audit API SQL Injection (CVE-2026-8054)";
flow:established,to_server;
content:"/api/auditPublishing/get";
http_uri;
pcre:"/\/api\/auditPublishing\/get(All)?[\?\&]/i";
pcre:"/(UNION\s+SELECT|pg_sleep|WAITFOR\s+DELAY|'\s*OR\s*'\s*1\s*'\s*=\s*'\s*1)/i";
sid:20268054; rev:1; reference:cve,2026-8054; metadata:created_at 2024_05_28;)

Elastic Detection (EQL)

sequence by source.ip with maxspan=30s
  [network where http.request.body_bytes > 0 or http.request.body.content != null
   and (url.path contains "/api/auditPublishing/get" or url.path contains "/api/auditPublishing/getAll")
   and (url.query contains "'" or url.query contains "%27" or url.query matches ".*(UNION|sleep|pg_sleep|information_schema).*")]

Splunk SPL Query

index=weblogs  sourcetype=access_combined_wcookie
(uri="/api/auditPublishing/get" OR uri="/api/auditPublishing/getAll")
| rex field=_raw "uri_query=(?<uri_query>.*)"
| where match(uri_query, "(?i)(union|select|pg_sleep|sleep\(|waitfor|delay|\x27)")
| table _time clientip uri uri_query status
| stats count by clientip uri uri_query

Wazuh OSSEC Rule

<rule id="202605" level="15">
    <if_sid>31100</if_sid>
    <field name="url">\./api/auditPublishing/get</field>
    <regex>(\/api\/auditPublishing\/get(All)?)</regex>
    <description>Intrusion attempt - dotCMS Audit API SQL injection (CVE-2026-8054)</description>
    <group>web_application_attack</group>
</rule>

Note: Base rule 31100 is the standard Apache access log rule. Adjust if_sid to match your Wazuh decoder pattern.

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source, not independently confirmed). Exercise caution but prioritize action.

1. Immediate Mitigations:

   • Block Network Access: At the WAF or reverse proxy (nginx/HAProxy) level, block external requests to /api/auditPublishing/* endpoints. Only allow them from internal backend IPs, as the Publish Audit is an administrative function.
   • Database Hardening: Immediately rotate any database credentials exposed via environment variables. Revoke FILE and SUPERUSER privileges from the dotCMS database user if not required.
   • WAF Rule: Implement a temporary SQLi rule to block queries containing UNION, pg_sleep, or single quotes in the URI parameters for those endpoints.

2. Patch / Upgrade Steps:

   • Upgrade to dotCMS Core 26.04.28-03 (or any newer stable release). This is the only trusted fix.
   • Independently verify the patch by reviewing the release notes for the fix description or checking the OSV advisory db0fae46600ded94e0df4f08e9c8e010c5930c7c.
   • After patching, configure the publishing-queue permission for the required backend users, as per the new security posture.

3. Long-term Hardening:

   • Segmentation: Ensure dotCMS database servers are in a private subnet, unreachable from the internet.
   • Patch Management: Subscribe to dotCMS security advisories and automate testing of LTS releases.
   • Web App Firewall: Deploy a commercial WAF with virtual patching policies for the dotCMS API.
   • Monitoring: Implement the detection rules above in your SIEM/IDS to catch future similar flaws.

Threat Intelligence Context

• CISA KEV Status: No. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this report. This means no confirmed exploitation in federal agencies has been reported.
• Exploit in the Wild: While the CNA does not report in-the-wild exploitation, the existence of a Nuclei template reduces exploitation complexity to a single command-line invocation. Nuclei templates are frequently used by threat actors in mass scanning campaigns.
• EPSS Score: 0.01584 (top 0.73 percentile). EPSS predicts a probability of exploitation in the wild within the next 30 days. While the score is low, the vulnerability's criticality and ease of exploitation imply that it will pop up in scanning activity soon, especially on Shodan-indexed dotCMS instances.
• Patch Confidence: The low patch confidence (2/4) is a red flag. Attackers may attempt to exploit this before the vendor's fix is fully rolled out or independently verified. The "LTS releases are not affected" statement suggests that enterprise long-term support customers might not receive an immediate hotfix, so they remain exposed if they rely solely on managed LTS.
• Threat Actors: Likely threat actors include ransomware groups looking for accessible enterprise CMS databases and state-sponsored groups conducting mass web server fingerprinting for espionage against content management systems.

References

1. NVD Entry (CVE-2026-8054): https://nvd.nist.gov/vuln/detail/CVE-2026-8054 — Primary reference for official vulnerability description and CVSS score.
2. OSV Advisory (Package ID: db0fae46600ded94e0df4f08e9c8e010c5930c7c): https://osv.dev/vulnerability/CVE-2026-8054 — Source for patch status and affected package fix state.
3. ProjectDiscovery Nuclei Template Repository: https://github.com/projectdiscovery/nuclei-templates — Search for CVE-2026-8054 for the public detection template.
4. dotCMS Official Security Advisories Page: https://www.dotcms.com/docs/latest/security-advisories — Vendor-specific security bulletins and release notes.
5. FIRST EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ — Reference for the EPSS score of 0.01584.