CVE-2026-82039 — UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supply…
Published: 2026-10-02 · CVSS: 8.7 · CVSS 4.0
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7