CVE-2026-38626 Details
Description
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.
A critical SQL injection vulnerability has been identified in Garlic-Hub version 1.0.1, specifically within the ItemsRepository.php file. This vulnerability allows attackers to manipulate database queries by exploiting improper handling of user input, leading to unauthorized data access or modification. The issue arises from the use of string concatenation for query parameters, which can be exploited to execute arbitrary SQL commands.
To address this vulnerability, it is recommended to update the SQL query handling in the affected repository file to use prepared statements instead of concatenating user input directly into the query. This change should be applied to all repository files in the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GaurishBahurupi/SQLI-in-Garlic-Hub/blob/main/REPORT.md | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Garlic-Hub | 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |