CVE-2026-108963: Command Injection
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using databasement versions earlier than 1.8.2 are affected when authenticated users can specify a database name for commands such as mariadb-dump.
What level of access does an attacker need?
An attacker needs authenticated, low-privilege access. Exploitation can be performed remotely, requires low attack complexity, and does not require user interaction.
How can I determine whether an installation is affected?
Check the databasement version and review whether authenticated users can provide database names to backup or dump functionality that invokes mariadb-dump or similar commands. Versions before 1.8.2 meet the affected version condition.
What is the available remediation?
Update databasement to version 1.8.2 or later. The issue affects versions before 1.8.2.