CVE-2026-22242 CoreShop Vulnerable to SQL Injection via Admin Reports
An authenticated administrator can exploit a blind SQL injection vulnerability in CoreShop to extract confidential database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22242?
CVE-2026-22242 is a medium-severity SQL injection vulnerability in CoreShop, published on 8 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.
Which versions are affected by CVE-2026-22242?
2 open source packages ship an affected version, including coreshop/core-shop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
coreshop/core-shop Packagist | All versions | 4.1.8 |
coreshop/core-shop Packagist | All versions | 4.1.8 |
Products include Coreshop Coreshop.
How do I fix CVE-2026-22242?
Upgrade coreshop/core-shop to 4.1.8 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-22242 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22242 exists.
Other vulnerabilities in CoreShop
Sources
Also known as GHSA-ch7p-mpv4-4vg4.