What is the CVSS score of CVE-2026-38739?

CVE-2026-38739 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of eZ Publish Legacy are affected by CVE-2026-38739?

eZ Publish Legacy contains an unpatched SQL injection vulnerability in the dfscleanup.php script that allows authenticated local users with sufficient privileges to extract sensitive data including…

How to fix or mitigate CVE-2026-38739?

Within 24 hours: Inventory all deployed instances of eZ Publish Legacy, identify systems where dfscleanup.php is accessible to local users, and document current access controls. Within 7 days: Disable dfscleanup.php if not operationally required; if required, implement strict file-system access controls limiting execution to essential accounts only and audit all database user privileges. Within 30 days: Execute migration plan to a vendor-supported platform or implement compensating controls including database access monitoring, privilege separation, and network isolation.

eZ Publish Legacy CVE-2026-38739

HIGH

SQL Injection (CWE-89)

2026-05-29 https://github.com/ezsystems/ezpublish-legacy

GHSA-xg9x-h37w-h3r3

PHP Information Disclosure SQLi

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 29, 2026 - 19:45 vuln.today

Analysis Generated

May 29, 2026 - 19:45 vuln.today

DescriptionGitHub Advisory

NB: All tags and branches in this repository are past their end of life, so the vulnerability will not be fixed. The advisory is posted on the request of the researcher, for the information of anyone who might still use this software.

Impact

There is a security vulnerability in eZ Publish Legacy, affecting the dfscleanup.php script and the _getFileList function of the eZDFSFileHandlerMySQLiBackend class (kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php). The vulnerability allows an attacker with local shell access and sufficient privileges to run dfscleanup.php to perform a union-based SQL injection against the eZ Publish MySQL database, potentially exposing sensitive data such as user credentials.

It is known to affect the branch 2019.03, and it may well affect other branches.

Credit

The issue was found and reported by security auditor Timothé Ridel from Advens: https://www.advens.com/

Patches

None, the software is past its end of life.

Workarounds

None.

Resources

Report by Advens: https://github.com/Goaterino/ezpublish-legacy-lab/blob/main/SQL%20injection%20and%20arbitrary%20file%20deletion%20in%20dfscleanup.md

AnalysisAI

Union-based SQL injection in eZ Publish Legacy's dfscleanup.php script allows a local authenticated attacker with sufficient privileges to extract sensitive data, including user credentials, from the underlying MySQL database. The flaw resides in the _getFileList function of the eZDFSFileHandlerMySQLiBackend class and is permanently unpatched because all branches of the project have reached end of life. No public exploit identified at time of analysis, though a detailed researcher write-up exists on GitHub.

Technical ContextAI

eZ Publish Legacy is a PHP-based content management system (composer package ezsystems/ezpublish-legacy) historically maintained by eZ Systems. The vulnerable component is the DFS (Distributed File System) cluster file handler backend located at kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php, specifically the _getFileList method invoked via the dfscleanup.php maintenance script. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated directly into a MySQL query rather than parameterized, enabling a UNION-based injection that lets the attacker append arbitrary SELECT statements to the original query and exfiltrate column data from any table the database user can read.

RemediationAI

No vendor-released patch identified at time of analysis - the project is past end of life and the vendor explicitly states none will be issued, and the advisory lists no workarounds. The only durable remediation is to migrate off eZ Publish Legacy to a supported CMS (such as Ibexa DXP, the successor product). As interim compensating controls, restrict OS-level access so that no untrusted users hold shell accounts on hosts running eZ Publish, remove or chmod 000 the dfscleanup.php script if scheduled cleanup is not in use (side effect: orphaned DFS files will accumulate and disk usage will grow over time), tightly restrict the MySQL account used by eZ Publish to the minimum required tables and revoke FILE/SUPER privileges to limit the blast radius of any successful injection, and audit historical execution of dfscleanup.php via shell history and process accounting. Full advisory text is at https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-xg9x-h37w-h3r3 and the technical writeup is at https://github.com/Goaterino/ezpublish-legacy-lab/blob/main/SQL%20injection%20and%20arbitrary%20file%20deletion%20in%20dfscleanup.md.