SQL Injection Vulnerability in Apache Cocoon Affects All Versions

CVE-2026-108087

What is CVE-2026-108087?

An SQL injection vulnerability has been identified in Apache Cocoon due to inadequate input sanitation. This flaw allows for the execution of arbitrary SQL commands through the SQL processor or sql:/esql: logicsheets, potentially compromising the integrity and security of the application. Given that Apache Cocoon is a retired project, no patches or updates will be made available to address this issue. It is advised that users either switch to alternative solutions or restrict access to the affected instances to trusted users only.

References