Dynamic LINQ Injection Vulnerability in Edito CMS by Edito
CVE-2026-59075

7.1HIGH

Key Information:

Vendor

Edito

Status
Edito Cms
Vendor
CVE Published:
13 November 2026

What is CVE-2026-59075?

Edito CMS is susceptible to a Dynamic LINQ injection due to inadequate input validation. An attacker with authentication can exploit this vulnerability by injecting conditional expressions into the sorting parameters of paginated administrative endpoints. This manipulation can lead to the extraction of sensitive data, as the attacker can analyze the order of returned results to retrieve field values character by character. A fix has been implemented in version 5.10.2607, and hotfixes for prior versions, particularly 5.8, are also available.

Affected Version(s)

Edito CMS 0 < 5.10.2607

References

https://cert.pl/posts/2026/11/CVE-2026-59074
third-party-advisory
https://www.edito.pl/
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Dawid Małecki (AFINE Team)
​Paweł Zdunek (AFINE Team)
.