An SQL injection flaw allows attackers to execute arbitrary SQL statements against the Friendica database. The vulnerable code directly concatenates the photo‑view order parameter into a SHOW COLUMNS query using PDO::query(), enabling stacked statement injection. This flaw enables reading, modifying, or deleting the entire database, thereby destroying confidentiality, integrity, and availability of all stored data.

The vulnerability exists in the Friendica application distributed by the Friendica project, specifically within the 2026.08‑dev development branch. The affected code path is likely present in any builds that incorporate this branch without modification. Thus any Friendica deployment running a version derived from 2026.08‑dev is at risk.

Cybersecurity controls will rate this as a critical vulnerability with a CVSS score of 9.8. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, yet the attack vector is remote, unauthenticated, and requires no prior login, as inferred from the description. The stacked statement injection capability means a single malicious request can fully compromise the database, making the risk level very significant for any exposed Friendica deployment.