CVE-2026-31952 Xibo CMS API has SQL Injection via DataSet Filter Parameter
Authenticated users with specific privileges can inject SQL into the DataSet filter parameter to read and modify arbitrary database data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31952?
CVE-2026-31952 is a high-severity SQL injection vulnerability in xibosignage xibo-cms, published on 24 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the API filter parameter. Exploitation of the vulnerability is possible on behalf of an authorized user who has either of the `Access to DataSet Feature` privilege or the `Access to the Layout Feature` privilege. Users should upgrade to version 4.4.1 which fixes this issue. Customers who host their CMS with Xibo Signage have been patched if they are using 4.4, 4.3, 3.3, 2.3 or 1.8. Upgrading to a fixed version is necessary to remediate. Patches are available for earlier versions of Xibo CMS that are out of support, namely 3.3, 2.3, and 1.8.
Which versions are affected by CVE-2026-31952?
It affects 1 product.
Products include Xibosignage Xibo.
How do I fix CVE-2026-31952?
No fix has been published for CVE-2026-31952 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-31952 being exploited?
There is no known exploitation of CVE-2026-31952 in the wild and no public exploit code.
Other vulnerabilities in xibosignage xibo-cms
- CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip
- CVE-2024-41802 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import
- CVE-2013-4887 SQL injection in n/a
- CVE-2025-62369 Xibo CMS: Remote Code Execution through module templates
- CVE-2013-4889 Cross-site request forgery in n/a
Sources
Also known as GHSA-rq92-f6fv-3629.