Description
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon.



This issue affects Apache Cocoon: all versions.



Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to unauthorized database access or modification
Action: Find Alternative
AI Analysis

Impact

The vulnerability is an improper neutralization of special elements used in an SQL command, enabling arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets. An attacker can execute arbitrary SQL statements against the backend database, allowing data disclosure, modification, or deletion.

Affected Systems

Apache Software Foundation’s Apache Cocoon; all versions are affected. The product is retired and no official fixes will be released.

Risk and Exploitability

The CVSS score is 8.8, EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. The absence of a patch and the nature of SQL injection mean the risk remains high. The attack vector appears to be through the Cocoon application’s SQL processing interfaces; if the application is exposed to external users, a remote attacker could supply crafted payloads, while internal users could exploit the flaw locally. The potential impact includes full database compromise and exposure of sensitive data.

Generated by OpenCVE AI on October 29, 2026 at 21:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy an alternative application or retire Apache Cocoon
  • Restrict network access to the Cocoon instance to trusted users only, using firewall or application‑level authentication
  • If the Cocoon instance must remain in use, isolate it behind a reverse proxy and lock down exposed interfaces to prevent unauthenticated SQL injection attempts

Generated by OpenCVE AI on October 29, 2026 at 21:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 20 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache cocoon
Vendors & Products Apache
Apache cocoon

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Title Apache Cocoon: SQL Injection
Weaknesses CWE-89
References

Subscriptions

Apache Cocoon
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-29T18:21:55.393Z

Reserved: 2026-10-09T12:23:18.150Z

Link: CVE-2026-108087

cve-icon Vulnrichment

Updated: 2026-10-20T18:09:55.074Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T11:17:16.783

Modified: 2026-10-29T19:17:15.700

Link: CVE-2026-108087

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T21:30:15Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')