SQL Injection Vulnerability in Masa CMS Affects Multiple Versions
CVE-2026-40331

9.3CRITICAL

Key Information:

Vendor

Masacms

Status
Masacms
Vendor
CVE Published:
5 May 2026

What is CVE-2026-40331?

Masa CMS, an open-source content management system, is susceptible to a SQL injection vulnerability across several versions, allowing an unauthenticated attacker to exploit the JSON API. By injecting malicious input via the 'altTable' parameter, attackers can execute arbitrary SQL queries and potentially gain access to sensitive information, including administrative credentials and password reset tokens. This vulnerability highlights the importance of implementing proper input validation and sanitization to protect against unauthorized data access. Users are advised to upgrade to patched versions 7.2.10, 7.3.15, 7.4.10, or 7.5.3, or to apply necessary workarounds to safeguard their installations.

Affected Version(s)

MasaCMS <= 7.2.9 <= 7.2.9

MasaCMS >= 7.3.0, <= 7.3.14 <= 7.3.0, 7.3.14

MasaCMS >= 7.4.0, <= 7.4.9 <= 7.4.0, 7.4.9

References

https://github.com/MasaCMS/MasaCMS/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.