CVE-2026-38626

Garlic-Hub v1.0.1 contains a SQL injection flaw (CWE-89) in src/Modules/Items/Repositories/ItemsRepository.php, where input handled by the Items repository is incorporated into database queries without adequate sanitization. The vulnerability is network-exploitable with no authentication, user interaction, or privileges required, reflected in a critical CVSS 3.1 base score of 9.8. A remote attacker who reaches an affected instance can inject arbitrary SQL to read, modify, or delete the application's database contents, potentially bypassing authentication and pivoting to deeper server compromise depending on the database user's privileges. Anyone running a publicly reachable Garlic-Hub v1.0.1 deployment is affected; self-hosted instances exposed to the internet are at greatest risk. No public proof of concept is known and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no indication of active exploitation.

What to do: Upgrade Garlic-Hub to the latest release as soon as a patched version is published (the advisory only confirms 1.0.1 as vulnerable, so check the upstream repository for a fix). Until patched, place the instance behind a VPN or an authenticating reverse proxy so it is not reachable unauthenticated from the internet, and consider WAF/SQL-injection filtering on items-related endpoints. Review the application database for unexpected records, modified admin credentials, or evidence of injected queries.