{"items":[{"id":"NVI-00003196","kind":"vulnerability","title":"ezsystems/ezpublish-legacy has a SQL injection in dfscleanup","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xg9x-h37w-h3r3","CVE-2026-38739"],"plain_summary":"GitHub lists this reviewed advisory for ezsystems/ezpublish-legacy. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-35f236e32d93d8815e8d3ecc7ecac1a8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-05-29T19:07:41.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-31bc7a1a468a9fcba92570b6de266b8d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-31bc7a1a468a9fcba92570b6de266b8d","url":"https://github.com/advisories/GHSA-xg9x-h37w-h3r3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xg9x-h37w-h3r3","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:53:22.747Z"},{"id":"sr-35f236e32d93d8815e8d3ecc7ecac1a8","url":"https://github.com/advisories/GHSA-xg9x-h37w-h3r3","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xg9x-h37w-h3r3","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.444Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-31bc7a1a468a9fcba92570b6de266b8d"],"technology":"ezsystems/ezpublish-legacy","known_exclusions":[],"conditions_summary":"NB: All tags and branches in this repository are past their end of life, so the vulnerability will not be fixed. The advisory is posted on the request of the researcher, for the information of anyone who might still use this software.\n\n### Impact\nThere is a security vulnerability in eZ Publish Legacy, affecting the dfscleanup.php script and the `_getFileList` function of the `eZDFSFileHandlerMySQLiBackend` class (kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php). The vulnerability allows an attacker with local shell access and sufficient privileges to run dfscleanup.php to perform a union-based SQL injection against the eZ Publish MySQL database, potentially exposing sensitive data such as user credentials.\n\nIt is known to affect the branch 2019.03, and it may well affect other branches.\n\n### Credit\nThe issue was found and reported by security auditor Timothé Ridel from Advens:\nhttps://www.advens.com/\n\n### Patches\nNone, the software is past its end of life.\n\n### Workarounds\nNone.\n\n### Resources\n- Report by Advens: https://github.com/Goaterino/ezpublish-legacy-lab/blob/main/SQL%20injection%20and%20arbitrary%20file%20deletion%20in%20dfscleanup.md","public_affected_ranges":["= 2019.03"]},{"certainty":"source_listed","source_ids":["sr-35f236e32d93d8815e8d3ecc7ecac1a8"],"technology":"ezsystems/ezpublish-legacy","known_exclusions":[],"conditions_summary":"NB: All tags and branches in this repository are past their end of life, so the vulnerability will not be fixed. The advisory is posted on the request of the researcher, for the information of anyone who might still use this software.\n\n### Impact\nThere is a security vulnerability in eZ Publish Legacy, affecting the dfscleanup.php script and the `_getFileList` function of the `eZDFSFileHandlerMySQLiBackend` class (kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php). The vulnerability allows an attacker with local shell access and sufficient privileges to run dfscleanup.php to perform a union-based SQL injection against the eZ Publish MySQL database, potentially exposing sensitive data such as user credentials.\n\nIt is known to affect the branch 2019.03, and it may well affect other branches.\n\n### Credit\nThe issue was found and reported by security auditor Timothé Ridel from Advens:\nhttps://www.advens.com/\n\n### Patches\nNone, the software is past its end of life.\n\n### Workarounds\nNone.\n\n### Resources\n- Report by Advens: https://github.com/Goaterino/ezpublish-legacy-lab/blob/main/SQL%20injection%20and%20arbitrary%20file%20deletion%20in%20dfscleanup.md","public_affected_ranges":[]}],"null_published_at":"2026-11-07T07:07:39.844Z","source_updated_at":"2026-05-29T19:07:41.000Z","source_disclosed_at":"2026-05-29T19:07:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:51.444Z"},{"id":"NVI-00003196","kind":"vulnerability","title":"ezsystems/ezpublish-legacy has a SQL injection in dfscleanup","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xg9x-h37w-h3r3","CVE-2026-38739"],"plain_summary":"OSV carries this publisher advisory for ezsystems/ezpublish-legacy. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-35f236e32d93d8815e8d3ecc7ecac1a8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-35f236e32d93d8815e8d3ecc7ecac1a8","url":"https://github.com/advisories/GHSA-xg9x-h37w-h3r3","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xg9x-h37w-h3r3","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.444Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-35f236e32d93d8815e8d3ecc7ecac1a8"],"technology":"ezsystems/ezpublish-legacy","known_exclusions":[],"conditions_summary":"NB: All tags and branches in this repository are past their end of life, so the vulnerability will not be fixed. The advisory is posted on the request of the researcher, for the information of anyone who might still use this software.\n\n### Impact\nThere is a security vulnerability in eZ Publish Legacy, affecting the dfscleanup.php script and the `_getFileList` function of the `eZDFSFileHandlerMySQLiBackend` class (kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php). The vulnerability allows an attacker with local shell access and sufficient privileges to run dfscleanup.php to perform a union-based SQL injection against the eZ Publish MySQL database, potentially exposing sensitive data such as user credentials.\n\nIt is known to affect the branch 2019.03, and it may well affect other branches.\n\n### Credit\nThe issue was found and reported by security auditor Timothé Ridel from Advens:\nhttps://www.advens.com/\n\n### Patches\nNone, the software is past its end of life.\n\n### Workarounds\nNone.\n\n### Resources\n- Report by Advens: https://github.com/Goaterino/ezpublish-legacy-lab/blob/main/SQL%20injection%20and%20arbitrary%20file%20deletion%20in%20dfscleanup.md","public_affected_ranges":[]}],"null_published_at":"2026-10-31T22:12:43.399Z","source_updated_at":"2026-09-10T03:50:47.968Z","source_disclosed_at":"2026-05-29T19:07:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:51.444Z"}],"next_cursor":null,"snapshot_revision":"42594"}