CVE-2026-108963databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user.
Updated under an hour ago ()
Does this affect you?
It affects David-Crty databasement. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 1.69%, higher than 77% of scored CVEs.
Do this next
Free account, 1 product
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-88
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 1.69% (percentile 77)
- Assigned by
- mitre
- NVD analysis
- Deferred
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 11, 2026
Affected products
David-Crty databasement david_crty:databasement (from the name) | from 1.0.0 before 1.8.2 | CNA record |
References
- https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcmvendor-advisory, exploit, technical-description
- https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22product
- https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862c
- https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499
- https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3not-applicable
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.