Friendica CVE-2026-72550

No special conditions - remote unauthenticated exploitation against default configurations of Friendica up to the 2026.08-dev branch. The specific prerequisite is network reachability of the photo-view feature and the ability to control its 'order' parameter, which is exposed without authentication; stacked-statement (multi-statement) execution is possible because the code path uses a bare PDO::query() call rather than a prepared statement. Limiting factors are minimal: exploitation does not require user interaction, credentials, or a non-default setting, so the primary real-world limiter is simply how many Friendica instances are internet-exposed and whether an upstream WAF or proxy filters the 'order' parameter.

The signals are internally consistent and point to genuine high priority rather than an inflated CVSS: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, unauthenticated, low-complexity exploitation with no user interaction and total impact on confidentiality, integrity, and availability, which matches a description of unauthenticated stacked-statement SQL injection reaching the whole database. Mitigating the urgency somewhat, there is no CISA KEV listing and no public proof-of-concept identified at time of analysis, and EPSS was not provided - so there is currently no evidence of active or widespread exploitation, and the real-world blast radius is constrained by Friendica's relatively small, self-hosted deployment footprint. That said, any operator running an internet-facing Friendica instance should treat this as urgent because the barrier to exploitation is near-zero and the impact is complete database compromise; the main open question is patch availability, since the only reference is the project's GitHub repository with no confirmed fixed version. Verify the exact fixed commit/release with the Friendica maintainers before assuming remediation.

An attacker locates an internet-facing Friendica instance and sends a single crafted HTTP request to the photo-view functionality with a malicious 'order' parameter that closes the intended SHOW COLUMNS query and appends attacker-controlled SQL. Because no authentication is required and the query path allows stacked statements, the attacker dumps user credentials and private posts, or issues UPDATE/DROP statements to modify or destroy the database, all without any user interaction. No public exploit code has been identified yet, but the attack is straightforward to weaponize given the described injection point.