CVE-2026-61518 ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
Authenticated attackers can inject SQL via the Remote API to read or modify database records across all tenants.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61518?
CVE-2026-61518 is a high-severity SQL injection vulnerability in ispconfig3, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject requests in its default configuration. A remote API user holding any single low-privilege function permission can inject arbitrary SQL to delete or modify records across all tenants in the control panel database and extract arbitrary data via blind boolean inference, including password hashes and client records.
Weakness: CWE-89
Which versions are affected by CVE-2026-61518?
How do I fix CVE-2026-61518?
No fix has been published for CVE-2026-61518 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-61518 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61518 exists.
Sources
Also known as GHSA-m99h-35x2-cjq2.