What is the CVSS score of CVE-2026-31891?

CVE-2026-31891 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-31891?

A SQL injection vulnerability in Cockpit CMS versions 2.13.4 and earlier allows attackers with read-only API access to extract sensitive data from the content database, including unpublished…. A patch is available.

How to fix or mitigate CVE-2026-31891?

Within 24 hours: Audit all exposed Cockpit CMS instances and document which versions are running; restrict API access to trusted networks only. Within 7 days: Evaluate upgrade to version 2.14.0 or later once available, or migrate to alternative CMS if timeline is critical. Within 30 days: Complete patching or replacement; implement WAF rules to block SQL metacharacters in aggregation query parameters; conduct access logs review for exploitation indicators.

PHP CVE-2026-31891

HIGH

SQL Injection (CWE-89)

2026-03-17 https://github.com/Cockpit-HQ/Cockpit

GHSA-7x5c-vfhj-9628

PHP SQLi

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 17:07 nvd

HIGH 7.7

DescriptionGitHub Advisory

Impact

This is a SQL Injection vulnerability in the MongoLite Aggregation Optimizer.

Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected.

Who is impacted:

Any deployment where the /api/content/aggregate/{model} endpoint is publicly

accessible or reachable by untrusted users.

Attackers in possession of a valid read-only API key (the lowest privilege level)

can exploit this vulnerability - no admin access is required.

What an attacker can do:

Inject arbitrary SQL via unsanitized field names in aggregation queries.
Bypass the _state=1 published-content filter to access unpublished or restricted content.
Extract unauthorized data from the underlying SQLite content database.

Confidentiality impact is High. Integrity and availability are not directly affected by this vulnerability.

Patches

This vulnerability has been patched in version 2.13.5.

All users running Cockpit CMS version 2.13.4 or earlier are strongly advised to upgrade to 2.13.5 or later immediately.

https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5

The fix applies the same field-name sanitization introduced in v2.13.3 for toJsonPath() to the toJsonExtractRaw() method in lib/MongoLite/Aggregation/Optimizer.php, closing the injection vector in the Aggregation Optimizer.

AnalysisAI

SQL injection in Cockpit CMS version 2.13.4 and earlier allows attackers with a valid read-only API key to inject arbitrary SQL through the /api/content/aggregate/{model} endpoint and extract unauthorized data from the SQLite database, including unpublished content. The vulnerability requires network access and low-privilege API credentials, enabling data exfiltration without administrative privileges. No patch is currently available.

Technical ContextAI

The vulnerability affects Cockpit CMS (CPE: pkg:composer/cockpit-hq_cockpit), specifically in the MongoLite Aggregation Optimizer component at the /api/content/aggregate/{model} endpoint. As classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the flaw stems from inadequate input sanitization in the toJsonExtractRaw() method within lib/MongoLite/Aggregation/Optimizer.php, where field names are not properly sanitized before being incorporated into SQL queries. MongoLite is Cockpit's embedded database abstraction layer that translates MongoDB-style queries to SQLite operations, and the vulnerability allows injection at this translation layer.

RemediationAI

Immediately upgrade Cockpit CMS to version 2.13.5 or later, which applies proper field-name sanitization to the toJsonExtractRaw() method (see release at https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5). For installations that cannot immediately upgrade, consider temporarily restricting access to the /api/content/aggregate/{model} endpoint through web server configuration or firewall rules, limiting API access to trusted IP addresses only. Review and rotate any API keys that may have been exposed, as even read-only keys can be used to exploit this vulnerability.