SQL inyection in Umami Software application
Umami Software application, version 3.0.2.
INCIBE has coordinated the publication of a critical severity vulnerability affecting Umami Software application, a analytics platform. The vulnerability was discovered by Hector Ruiz Ruiz & NaxusAI.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-4317: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:H | CWE-89
The vulnerability has been fixed by Umami Software team in version 3.0.3.
CVE-2026-4317: SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute arbitrary SQL commands in the database.Specifically, they could manipulate the value of the 'timezone' request parameter by including malicious characters and SQL payload. The application would interpolate these values directly into the SQL query without first performing proper filtering or sanitization (e.g., using functions such as 'prisma.rawQuery', 'prisma.$queryRawUnsafe' or raw queries with 'ClickHouse'). The successful explotation of this vulnerability could allow an authenticated attacker to compromiso the data of the database and execute dangerous functions.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-4317 | Crítica | No | Umami Software |
