SQL Injection Vulnerability in Masa CMS Affects Multiple Versions

CVE-2026-40329

What is CVE-2026-40329?

Masa CMS, an open-source content management system, is susceptible to a SQL injection vulnerability found in the beanFeed.cfc component. Specifically, the flaw lies in the getQuery function's handling of the sortBy parameter, where user input is not adequately sanitized or parameterized. This oversight allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data, manipulation or deletion of database records, or privilege escalation to gain administrative control. To mitigate risks, users are advised to update to versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3, or implement Web Application Firewall (WAF) rules to block harmful SQL patterns in the sortBy parameter.

References