PocketBase EUVD-2026-80831

Requires a network-reachable PocketBase instance prior to 0.22.48 (0.22.x line) or 0.39.7 (0.23.0-0.39.6 line). The flaw is that PocketBase's panic-recovery middleware protects normal request handling but NOT internal child/worker goroutines: backup restore (apis/backup.go), logger init (core/base.go), jsvm hook watcher (plugins/jsvm), cron scheduler (tools/cron), s3lite uploads, and the Execute() startup routines. A panic in any of these - for example the view-query parser panicking on an unsupported wildcard '*' column (daos/view.go, also hardened in the fix) - escapes recovery and kills the process. LIMITING FACTORS: several affected paths (backup restore, view/collection creation, jsvm hooks, cron config) are reachable only by an authenticated superuser or via server configuration, so a truly unauthenticated remote trigger is not clearly demonstrated in the advisory; impact is limited to availability (process crash, restart required) with no data exposure or code execution.

The signals are consistent that this is a genuine but availability-only issue, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) yields 8.7 (High) driven entirely by VA:H - there is NO confidentiality or integrity impact (VC:N/VI:N), so this is a pure denial-of-service via CWE-248 (uncaught exception). CISA SSVC tempers this: Exploitation=none (no observed active exploitation), Automatable=yes, Technical Impact=partial - a 'partial' impact and 'none' exploitation status argue against emergency prioritization. There is a tension in the data: the vendor CVSS asserts PR:N/AC:L (trivial unauthenticated trigger), yet the fixed code paths are largely internal/operator-driven goroutines - backup restore, logger init, jsvm hook watcher, cron scheduler, s3lite upload, and view-query parsing (the daos/view.go wildcard-column fix). Several of these (backup, view creation, jsvm) are superuser/admin or configuration-reachable, so a reliable unauthenticated remote panic trigger is not clearly established by the description - treat PR:N as vendor-asserted rather than confirmed. Net: real but low-to-moderate real-world priority - a crash bug, not code execution or data exposure, with no evidence of exploitation in the wild.

An attacker sends input that reaches one of PocketBase's internal worker goroutines (e.g. a crafted view-collection query using a wildcard '*' column, or another path that panics) so that the panic occurs outside the HTTP panic-recovery middleware. Because the child/worker goroutine's panic is not recovered, it propagates and terminates the entire server process, taking the backend offline until restarted. The vendor security advisory and fix commits are public, so the affected code paths and the trigger conditions are documented, though no standalone weaponized exploit is referenced.