CVE-2026-40329: SQL Injection vulnerability via sortBy in beanFeed
Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control.
This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Masa CMS (beanFeed.cfc getQuery sortBy SQL injection)to a version that resolves this vulnerability.Fixed in 7.5.3 - Upgrade
Upgrade
Masa CMS (beanFeed.cfc getQuery sortBy SQL injection)to a version that resolves this vulnerability.Fixed in 7.4.10 - Upgrade
Upgrade
Masa CMS (beanFeed.cfc getQuery sortBy SQL injection)to a version that resolves this vulnerability.Fixed in 7.3.15 - Upgrade
Upgrade
Masa CMS (beanFeed.cfc getQuery sortBy SQL injection)to a version that resolves this vulnerability.Fixed in 7.2.10 - Compensating control
Configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40329?
CVE-2026-40329 has a high severity rating due to its potential for allowing SQL injection attacks.
How do I fix CVE-2026-40329?
To fix CVE-2026-40329, upgrade your Masa CMS to version 7.5.3 or later, which includes a patch for this vulnerability.
What versions of Masa CMS are affected by CVE-2026-40329?
Masa CMS versions 7.5.2 and earlier are affected by CVE-2026-40329.
What type of attack can exploit CVE-2026-40329?
CVE-2026-40329 can be exploited through SQL injection, allowing unauthorized access to the database.
What component of Masa CMS is vulnerable in CVE-2026-40329?
The vulnerability in CVE-2026-40329 is located in the beanFeed.cfc component, specifically within the getQuery function.