{"id":"CVE-2026-59075","aliases":[],"cve":{"records":[{"id":"CVE-2026-59075","source":"CERT-PL","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-02T08:57:58.309Z","published":"2026-11-13T07:26:52.240Z","modified":"2026-11-13T07:26:52.240Z"}],"publishers":[{"name":"CERT-PL","role":"CNA","organizationId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","modified":"2026-11-13T07:26:52.240Z"}],"references":[{"url":"https://cert.pl/posts/2026/11/CVE-2026-59074","tags":["third-party-advisory"],"source":"CERT-PL"},{"url":"https://www.edito.pl/","tags":["product"],"source":"CERT-PL"}],"weaknesses":[{"id":"CWE-917","description":"CWE-917 Improper neutralization of special elements used in an expression language statement ('expression language injection')","source":"CERT-PL"}],"applicability":[],"prioritization":[]},"title":"Dynamic LINQ Injection in Edito CMS","titleSource":"CERT-PL","descriptionSource":"CERT-PL","description":"Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","score":7.1,"severity":"high","published":"2026-11-13T07:26:52.240Z","modified":"2026-11-13T07:26:52.240Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Edito","name":"Edito CMS","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"5.10.2607","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"CERT-PL","url":"https://www.cve.org/CVERecord?id=CVE-2026-59075"}],"remediation":[],"references":["https://cert.pl/posts/2026/11/CVE-2026-59074","https://www.edito.pl/"],"sources":[{"name":"CVE","id":"CVE-2026-59075","modified":"2026-11-13T07:26:52.240Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-59075"}],"assessments":[{"source":"CERT-PL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-13T12:40:00.136Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:45:32.518Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T09:50:36.128Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T09:45:31.996Z","attemptedAt":"2026-11-14T09:45:31.996Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T09:35:33.053Z","attemptedAt":"2026-11-14T09:35:33.053Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T09:35:33.098Z","attemptedAt":"2026-11-14T09:35:33.098Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124877","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124877","modified":"Nov 13, 2026, 7:26:52 AM","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-14T09:35:33.053Z"},{"source":"FIRST EPSS","id":"CVE-2026-59075","url":"https://www.first.org/epss/","probability":0.00243,"percentile":0.15647,"date":"2026-11-13","checkedAt":"2026-11-14T09:35:33.098Z"},{"source":"GitHub Advisory Database","id":"GHSA-39jf-vfwp-382c","url":"https://github.com/advisories/GHSA-39jf-vfwp-382c","modified":"2026-11-13T09:31:53Z","checkedAt":"2026-11-14T09:45:31.996Z"}],"aiSummary":{"text":"Edito CMS versions before 5.10.2607 are vulnerable to Dynamic LINQ injection, allowing an authenticated attacker to extract sensitive data by injecting conditional expressions into paginated administrative endpoints. The issue is due to improper input validation. An attacker can exploit this to expose sensitive data.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T14:11:06.771Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-59075"}]}}