CVE-2026-38626

CriticalCVSS 9.8

Published: 10/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. The flaw allows an attacker to manipulate database queries.

Risk Assessment

Exploitation could allow unauthorized access to, modification of, or deletion of data, and in severe cases full compromise of the database.

Recommendation

Update Garlic-Hub to a patched version or apply parameterized SQL queries in the affected file, and verify input validation is properly enforced.

Other vulnerabilities in Garlic-Hub

CVE-2026-47170High
Garlic-Hub, managing a digital signage network, prior to version 1.1 allowed authenticated users to send arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This enables internal port scanning, service fingerprinting, and retrieval of internal HTTP responses stored in the publicly accessible media pool.

Original NVD description (English source)

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.