CVE-2026-105146 Comsenz CVE debrief

Who should care

Defenders responsible for Comsenz Discuz! installations, particularly those using versions X5.0-20260801, X5.0-20260820, and X5.0-20260910, should assess exposure and prioritize verification of the vulnerability status.

Why it matters

CVE-2026-105146 is a SQL injection vulnerability in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Defenders should prioritize verifying the vulnerability status and assessing exposure of the Admin Medal Moderation component.

• Verify vulnerability status of Comsenz Discuz! versions
• Assess exposure of Admin Medal Moderation component
• Monitor for potential SQL injection attacks

Technical summary

The vulnerability is located in the modmedalsubmit function of the file upload/source/app/admin/child/medals/mod.php in the Admin Medal Moderation component of Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. The manipulation of the argument delete results in SQL injection, allowing for remote attacks. Defenders should prioritize verifying the vulnerability status of Comsenz Discuz! versions X5.0-20260801, X5.0-20260820, and X5.0-20260910, and assess exposure of the Admin Medal Moderation component. The exploit has been made public, and defenders should monitor for potential SQL injection attacks.

Defensive priority

Defenders should prioritize verifying the vulnerability status of Comsenz Discuz! versions X5.0-20260801, X5.0-20260820, and X5.0-20260910, and assess exposure of the Admin Medal Moderation component.

Recommended defensive actions

• Verify Comsenz Discuz! versions X5.0-20260801, X5.0-20260820, and X5.0-20260910 for vulnerability
• Assess exposure of the Admin Medal Moderation component
• Monitor for potential SQL injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The vendor was contacted but did not respond. The exploit has been made public and could be used. Defenders should verify the vulnerability status of Comsenz Discuz! versions X5.0-20260801, X5.0-20260820, and X5.0-20260910, focusing on the Admin Medal Moderation component. Evidence is limited, and further verification is required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.