UTMStack versions prior to 11.2.16 expose a SQL injection flaw in the UtmAssetGroupService.searchQueryBuilder() function. The flaw is triggered when malicious assetType and groupName values are injected into a native PostgreSQL query via String.format() without proper sanitization. As a result, an authenticated attacker can execute arbitrary SQL statements, allowing full read, write, and modification of the database and potentially enabling filesystem access through the database server.

UTMStack products before version 11.2.16. The platform includes an API endpoint GET /api/utm-asset-groups/searchGroupsByFilter that is directly affected by the flaw. Any deployment using the affected software and allowing authenticated users to access this endpoint is vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability. While no EPSS score is available, the absence of a KEV listing does not diminish the risk, as the attack vector is clear: an authenticated user supplies malicious input to the vulnerable endpoint. Exploitation requires legitimate credentials and access to the API, but once achieved it grants equivalent database owner privileges, enabling data exfiltration, tampering, or further compromise of the underlying operating system.