EUVD-2026-91790
GHSA-2c66-2qvh-84xr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege UTMStack account
-
DeliveryCraft malicious assetType/groupName parameters
-
ExploitInject SQL via searchGroupsByFilter endpoint
-
ExecutionExecute arbitrary SQL at DBA privilege
-
ImpactExfiltrate/modify database and reach filesystem
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session to UTMStack (CVSS PR:L - any valid low-privilege account suffices; no admin role is stated as necessary) and the ability to call GET /api/utm-asset-groups/searchGroupsByFilter supplying attacker-controlled assetType and groupName parameters, which UtmAssetGroupService.searchQueryBuilder() inserts unsanitized into a native PostgreSQL query via String.format(). No non-default configuration or user interaction is needed. The primary limiting factor is the authentication requirement; the primary impact amplifier is that the database connection holds DBA (PostgreSQL superuser-class) privileges, extending impact from data read/modify to potential filesystem access. Affected versions are UTMStack before 11.2.16. |
| Impact | This is a genuine, actionable vulnerability rather than a paper-tiger high-CVSS finding, but its real-world priority is tempered by prerequisites and footprint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) scores 8.7 and is internally consistent with the description: a classic CWE-89 SQL injection reachable over the network with low complexity, no user interaction, requiring only low-level authentication (PR:L). The amplifier is that the backing PostgreSQL connection runs with DBA privileges, so a successful injection yields full read, modification, and potential filesystem access - the highest impact tier. Counterbalancing signals: no EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is 'no public exploit identified at time of analysis' - do NOT treat this as actively exploited. The PR:L requirement means an attacker must already hold valid (even low-privilege) credentials to a UTMStack console, which meaningfully narrows the threat to insiders or post-credential-compromise scenarios. A notable data caveat: the patch commit referenced for this CVE (4e7a727…) shows a diff for InternalApiKeyFilter.java that explicitly cites a DIFFERENT issue, CVE-2026-82042, and the v11.2.16 release notes describe only alert-grouping fixes - so the actual SQLi remediation is not visible in the provided evidence and should be verified against the VulnCheck advisory. |
| Exploit ScenarioDerived | An attacker holding any low-privilege UTMStack account issues a GET request to /api/utm-asset-groups/searchGroupsByFilter with crafted assetType and groupName parameters. Because these values are concatenated into a native PostgreSQL query via String.format() without sanitization, the injected SQL executes with DBA privileges, letting the attacker dump credentials and security telemetry, alter records, or leverage PostgreSQL superuser functions toward filesystem access. No public exploit was identified at time of analysis, and exploitation requires valid authentication (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.
RemediationAI
Vendor-released patch: upgrade to UTMStack v11.2.16 (release tag https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16, patch reference https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd; vendor advisory: https://www.vulncheck.com/advisories/utmstack-sql-injection-via-searchgroupsbyfilter). Since the injection requires only a valid authenticated session and no admin role, the highest-value interim control is to restrict access to /api/utm-asset-groups/searchGroupsByFilter - place it behind a reverse-proxy rule or WAF signature that blocks requests containing SQL metacharacters (quotes, semicolons, comments, UNION, stacked statements) in the assetType and groupName query parameters, accepting the trade-off that legitimate values containing apostrophes may be rejected and that WAF filtering is bypassable by encoding tricks. If you cannot patch immediately, revoke or rotate access for accounts that do not need asset-group search, since every authenticated user is a potential trigger, and audit existing accounts for unexpected creation. As a deeper compensating control, downgrade the privileges of the database user UTMStack connects with so it no longer holds superuser/DBA rights (removing file-read/COPY PROGRAM capabilities and limiting blast radius), but test first because schema migrations, extensions and maintenance jobs may depend on elevated rights. Finally, review PostgreSQL logs and application audit trails for anomalous queries against asset-group tables and for file-system functions, which would indicate prior exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in the Java/Spring backend of UTMStack, an open-source SIEM/UTM platform. Inside UtmAssetGroupService.searchQueryBuilder(), attacker-supplied assetType and groupName values are concatenated into a native PostgreSQL query using String.format() rather than bound as JDBC parameters, so the injected fragments become part of the executed statement. The vulnerable surface is the Spring MVC handler backing GET /api/utm-asset-groups/searchGroupsByFilter, which is reachable with any authenticated account. The impact is amplified by the fact that the application's database connection is provisioned with DBA-level rights, which in PostgreSQL typically exposes superuser-only capabilities such as large object and file I/O functions (for example COPY ... TO/FROM PROGRAM or pg_read_file) that can reach the underlying filesystem. The supplied CPE cpe:2.3:a:utmstack:utmstack:*:*:*:*:*:*:*:* is unversioned, so the affected range comes from the advisory rather than the CPE itself: all UTMStack builds prior to 11.2.16 are in scope, across self-hosted deployments.
Know when Utmstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable API endpoint with low complexity and no UI; PR:L reflects the required low-privilege authentication, and DBA-level SQL execution yields full C/I/A impact with scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.
Executive ViewAI
UTMStack deployments running versions prior to 11.2.16 contain a high-severity SQL injection flaw that lets any valid low-privilege logged-in user issue arbitrary SQL against the platform's backend PostgreSQL database, which operates with DBA-class privileges - exposing stored data to unauthorized reading or modification and potentially the underlying host filesystem. Leadership should care because the affected data is the platform's own collected and stored content, so a single compromised or malicious low-privilege account could tamper with or exfiltrate it while requiring only legitimate credentials to do so. A vendor fix exists in v11.2.16, making this a manageable, time-bound remediation rather than an open-ended exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
UTMStack deployments running versions before 11.2.16 can be fully taken over through an authentication bypass in the Int
Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read
Account enumeration in UTMStack before 11.2.16 lets unauthenticated remote attackers submit arbitrary email addresses to
Missing authorization in UTMStack before 11.2.16 allows any authenticated user, regardless of role, to execute arbitrary
Server-side request forgery in UTMStack before 11.2.16 lets any authenticated user (even a low-privilege one) coerce the
Server-side request forgery (SSRF) in UTMStack before 11.2.16 is a genuine but moderate-severity issue rather than a top
Exploit-DB