SQL Injection Vulnerability in Friendica Affected by Unauthenticated Access

CVE-2026-72550

What is CVE-2026-72550?

An SQL injection vulnerability exists in Friendica through the 2026.08-dev branch. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. As this parameter is concatenated without proper escaping into a SHOW COLUMNS query through a PDO::query() call, attackers can perform stacked statement injections. Consequently, an attacker could potentially read, modify, or delete the database, highlighting a critical security concern for Friendica installations.

References