CVE-2026-72550: Friendica Friendica - SQL Injection

Q: What is the severity of CVE-2026-72550?

CVE-2026-72550 has a critical severity rating of 9.8.

Q: What types of attacks are possible with CVE-2026-72550?

CVE-2026-72550 allows unauthenticated remote attackers to execute arbitrary SQL statements.

Q: How do I fix CVE-2026-72550?

To fix CVE-2026-72550, it's essential to sanitize and escape all user inputs, particularly the photo-view order parameter.

Q: Which versions of Friendica are affected by CVE-2026-72550?

CVE-2026-72550 affects the Friendica through the 2026.08-dev branch.

Q: Can CVE-2026-72550 lead to data exposure?

Yes, CVE-2026-72550 can lead to high confidentiality and integrity impacts, resulting in potential data exposure.

Published Aug 11, 2026

Updated

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.

Affected Software

1 affected component

Friendica Friendica<=2026.08-dev

Event History

Aug 11, 2026

CVE Published

via MITRE·11:10 AM

Data Sourced

via MITRE·11:10 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72550?

CVE-2026-72550 has a critical severity rating of 9.8.

What types of attacks are possible with CVE-2026-72550?

CVE-2026-72550 allows unauthenticated remote attackers to execute arbitrary SQL statements.

How do I fix CVE-2026-72550?

To fix CVE-2026-72550, it's essential to sanitize and escape all user inputs, particularly the photo-view order parameter.

Which versions of Friendica are affected by CVE-2026-72550?

CVE-2026-72550 affects the Friendica through the 2026.08-dev branch.

Can CVE-2026-72550 lead to data exposure?

Yes, CVE-2026-72550 can lead to high confidentiality and integrity impacts, resulting in potential data exposure.

CVE-2026-72550: Friendica Friendica - SQL Injection

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72550?

What types of attacks are possible with CVE-2026-72550?

How do I fix CVE-2026-72550?

Which versions of Friendica are affected by CVE-2026-72550?

Can CVE-2026-72550 lead to data exposure?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72550?

What types of attacks are possible with CVE-2026-72550?

How do I fix CVE-2026-72550?

Which versions of Friendica are affected by CVE-2026-72550?

Can CVE-2026-72550 lead to data exposure?