CVE-2026-25993: EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / requestpath values—derived from the urlkey stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in urlkey , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25993?
CVE-2026-25993 has been classified as a high severity vulnerability due to its potential impact on database security.
How do I fix CVE-2026-25993?
To mitigate CVE-2026-25993, it is recommended to update EverShop to version 2.1.2 or later, which addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2026-25993?
CVE-2026-25993 is categorized as a Second-Order SQL Injection vulnerability affecting the URL rewrite processing.
Which versions of EverShop are affected by CVE-2026-25993?
CVE-2026-25993 affects EverShop versions up to and including 2.1.1.
How does CVE-2026-25993 impact application security?
CVE-2026-25993 can allow attackers to manipulate database queries via crafted category URLs, leading to unauthorized data access or modification.