The vulnerability originates from the V4StatisticsQuery handler in Homer, which forwards the user supplied rawquery field directly to DuckDB without applying sqlvalidator.ValidateRawSQL. An authenticated user can therefore issue arbitrary SQL statements against the FlightSQL service, potentially reading, modifying, or deleting any data that the service exposes. This flaw is a traditional string-based SQL injection (CWE-89) that can compromise database confidentiality and integrity.

Impact is limited to installations of sipcapture:Homer running any version older than 11.0.283. The vulnerability exists in the open source telecom observability platform and is mitigated in release 11.0.283 and later. Users running earlier releases must identify whether their deployment exposes the /api/v4/statistics/query endpoint to authenticated traffic.

The CVSS base score of 8.1 indicates high severity, and the lack of an available EPSS score means the overall exploitation probability is unknown but potentially significant due to the ability to execute arbitrary SQL. The vulnerability is not listed in the CISA KEV catalog, which suggests no publicly known exploits yet, but the authenticated nature of the attack makes it possible for an attacker who bypasses authentication to gain internal access. Assess the exposure of the FlightSQL service and prioritize the upgrade to the patched release.