SQL Injection Vulnerability in Umami Software Web Application
CVE-2026-4317

9.3CRITICAL

Key Information:

Vendor

Umami Software Application

Status
Umami Software
Vendor
CVE Published:
31 March 2026

What is CVE-2026-4317?

The vulnerability in the Umami Software web application arises from an improperly sanitized 'timezone' parameter, allowing authenticated attackers to execute arbitrary SQL commands within the database. By manipulating the request parameter with malicious characters and SQL payloads, threat actors can exploit this weakness. The application fails to adequately filter these values before incorporating them into SQL queries, lacking essential sanitization measures. This could potentially lead to severe data exposure and abuse of database functions.

Affected Version(s)

Umami Software 3.0.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-in...
patch

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hector Ruiz Ruiz & NaxusAI
.