CVE-2026-22242

MediumCVSS 4.9

Published: 08/01/2026(UTC)Updated: 06/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

CoreShop prior to version 4.1.8 contains a blind SQL injection vulnerability that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

Risk Assessment

Risk of disclosure of confidential data stored in the database, such as customer data or configuration, by an administrator with access to the application.

Recommendation

Upgrade CoreShop to version 4.1.8 or later, which includes a fix for the SQL injection vulnerability.

Other vulnerabilities in CoreShop

CVE-2026-41249High
CoreShop versions 5.0.1 through 5.1.0-beta.1 have a GitHub Actions workflow vulnerability allowing external attackers to achieve RCE by submitting a malicious Pull Request. The workflow uses `pull_request_target` and dangerously checks out code from the PR head.

Original NVD description (English source)

CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS