CVE-2026-72550
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query, enabling stacked statement injection.
Risk Assessment
An unauthenticated attacker can read, modify, or delete the entire database, leading to complete data loss and system compromise.
Recommendation
Update Friendica to a version that properly escapes parameters. Use parameterized queries instead of direct concatenation.
Other vulnerabilities in Friendica
Original NVD description (English source)
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS