Apache Cocoon SQL processor allows SQL injection (CVE-2026-108087)
Original title: CVE-2026-108087: Apache Cocoon: SQL Injection
Missing input sanitation in the SQL processor or sql: and esql: logicsheets affects every version.
Apache disclosed moderate-severity CVE-2026-108087, an SQL injection flaw in Apache Cocoon marked unsupported when assigned. Missing input sanitation allows arbitrary SQL injection through the SQL processor or the sql: and esql: logicsheets. All versions are affected. The notice says the project is retired; the remainder of the fix statement is cut off.
Unconfirmed: The notice is truncated after saying the project is retired, so the fix plan is not fully stated.
- Posted by Arnout Engelen on October 20.
- Apache rates the issue moderate.
- Injection is via the SQL processor or sql:/esql: logicsheets.
- The advisory text ends before fully stating the remediation.
Impact: Arbitrary SQL injection through Cocoon SQL features
| Product | Affected |
|---|---|
| Apache Cocoon | all versions |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108087 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon | 8.8 | — |
From the original article
Posted by Arnout Engelen on Oct 20 Severity: moderate Affected versions: - Apache Cocoon: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.