CVE-2026-62362 PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint
An authenticated attacker can exploit SQL injection in the analysis endpoint to read all data from the PeerBanHelper database.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62362?
CVE-2026-62362 is a medium-severity SQL injection vulnerability in PBH-BTN PeerBanHelper, published on 16 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.
Weakness: CWE-89
Which versions are affected by CVE-2026-62362?
How do I fix CVE-2026-62362?
No fix has been published for CVE-2026-62362 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-62362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62362 exists.
Sources
Also known as GHSA-pc89-mfwm-hj9x.