CVE-2026-22242 coreshop CVE debrief

Who should care

Defenders responsible for CoreShop installations, particularly those with administrator-level users, should assess exposure and apply the patch to prevent confidential data disclosure.

Why it matters

CVE-2026-22242 is a blind SQL injection vulnerability in CoreShop that allows an authenticated administrator-level user to extract database contents, potentially leading to confidential data disclosure. Defenders should prioritize verifying exposure and applying the patch.

• Confidential data disclosure is possible for an authenticated administrator-level user
• Verification of exposure and patch application is necessary to prevent data disclosure
• Database activity monitoring may be necessary to detect potential exploitation

Technical summary

The vulnerability exists in CoreShop prior to version 4.1.8 and allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. The vulnerability has been patched in version 4.1.8. Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows confidential data disclosure.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows confidential data disclosure.

Recommended defensive actions

• Verify exposure by checking if the installed version of CoreShop is prior to 4.1.8
• Apply the patch by upgrading to CoreShop version 4.1.8 or later
• Monitor database activity for suspicious queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and patched version. The vulnerability exists in CoreShop prior to version 4.1.8. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. The official CVE Program record and NVD detail page provide source-provided CVE metadata and source-specific vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.