Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

Vulnerability

Detail CVE-2026-31891 is a SQL injection vulnerability in the MongoLite Aggregation Optimizer component of Cockpit CMS. The flaw arises from unsanitized field names passed to the toJsonExtractRaw() method in lib/MongoLite/Aggregation/Optimizer.php, which directly concatenates them into SQL queries without proper escaping [1][4]. This mirrors a previous vulnerability in toJsonPath() that was fixed in v2.13.3 [4].

Exploitation

An attacker can exploit this vulnerability by sending a crafted aggregation request to the /api/content/aggregate/{model} endpoint. The attacker must possess a valid read-only API key, which is the lowest privilege level; no administrative access is required. The endpoint must be publicly accessible or reachable by untrusted users [1][4]. The injection occurs via field name parameters in the aggregation query, allowing arbitrary SQL to be executed against the underlying SQLite content database [4].

Impact

Successful exploitation enables the attacker to inject arbitrary SQL, bypass the _state=1 published-content filter, and access unpublished or restricted content. The attacker can also extract unauthorized data from the database, leading to a high confidentiality impact. Integrity and availability are not directly affected [1][4].

Mitigation

The vulnerability has been patched in Cockpit CMS version 2.13.5 [3]. The fix applies the same field-name sanitization used by toJsonPath() to the toJsonExtractRaw() method, closing the injection vector. All users running versions 2.13.4 or earlier are strongly advised to upgrade immediately [4].