CVE-2026-108799 jackq CVE debrief

Who should care

Defenders responsible for XCMS installations should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the presence of this vulnerability in their XCMS installations and apply patches or mitigations as available.

Why it matters

CVE-2026-108799 is a SQL injection vulnerability in jackq XCMS that allows remote attackers to inject malicious SQL code through the email argument in the password recovery endpoint. Defenders should prioritize verifying exposure, applying patches, and implementing input validation.

• Remote attackers may inject malicious SQL code, potentially leading to data breaches or system compromise.
• Defenders need to verify the presence of this vulnerability in their XCMS installations.
• Successful exploitation may allow attackers to extract or modify sensitive data.
• Remediation priority is high due to the potential for significant impact.

Technical summary

The vulnerability is located in the PublicController::sendFindPwdMail function of the Admin/Home/Controller/PublicController.class.php file in jackq XCMS up to version 3fab5342cc509945a7ce1b8ec39d19f701b89261. The manipulation of the email argument allows for SQL injection, enabling remote attackers to inject malicious SQL code. This vulnerability allows remote attackers to potentially extract or modify sensitive data. Defenders should prioritize verifying exposure, applying patches, and implementing input validation.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their XCMS installations and applying patches or mitigations as available.

Recommended defensive actions

• Verify the version of XCMS being used and check if it is vulnerable
• Apply patches or updates as available from the vendor
• Implement input validation and sanitization for user input in the password recovery endpoint
• Monitor for suspicious activity on the XCMS installation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. The exploit has been publicly disclosed and may be utilized. Defenders should verify the presence of this vulnerability in their XCMS installations and assess potential exposure. Evidence is limited, and further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.