CVE-2026-4317
CriticalSummary
There is an SQL injection (SQLi) vulnerability in the Umami Software web application due to an improperly sanitized parameter. This allows an authenticated attacker to execute arbitrary SQL commands in the database by manipulating the 'timezone' request parameter.
Risk Assessment
Exploitation of this vulnerability could lead to the compromise of database data and allow the attacker to execute dangerous functions. This poses a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to implement proper input sanitization and filtering mechanisms to prevent SQL injection. A security audit of the application should also be conducted to identify and remediate other potential vulnerabilities.
Original NVD description (English source)
SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute arbitrary SQL commands in the database.Specifically, they could manipulate the value of the 'timezone' request parameter by including malicious characters and SQL payload. The application would interpolate these values directly into the SQL query without first performing proper filtering or sanitization (e.g., using functions such as 'prisma.rawQuery', 'prisma.$queryRawUnsafe' or raw queries with 'ClickHouse'). The successful explotation of this vulnerability could allow an authenticated attacker to compromiso the data of the database and execute dangerous functions.