CVE-2026-40329 Details
Description
Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.
A SQL injection vulnerability has been identified in Masa CMS versions through 7.5.2. The issue resides in the beanFeed.cfc component, specifically within the getQuery function, where the sortBy parameter is processed. The vulnerability arises because the application does not adequately sanitize or parameterize this input before it is used in dynamic SQL statements. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the database. Exploitation of this vulnerability could lead to unauthorized access to sensitive data, modification or deletion of records, or escalation of privileges to gain administrative control over the CMS.
Users are advised to upgrade to Masa CMS versions 7.2.10, 7.3.15, 7.4.10, or 7.5.3. If an immediate upgrade is not possible, it is recommended to configure Web Application Firewall (WAF) rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc. Additionally, restrict network access to CMS administrative components to trusted IP addresses and ensure the database user account follows the principle of least privilege.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 5, 2026CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-3xpq-q494-8qq4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Masa CMS | <= 7.5.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |