CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection

Wed, 27 May 2026 00:00:00 +0000

1. Overview

A critical SQL injection vulnerability exists in the dotCMS Core content management system’s Publish Audit API. The /api/auditPublishing/getAll REST endpoint accepts a JSON array of bundle identifiers and passes them unsanitized into a SQL query via string concatenation, allowing an attacker to inject arbitrary SQL statements. The endpoint requires no authentication, enabling an unauthenticated remote attacker to read, modify, or destroy the entire dotCMS PostgreSQL database with a single HTTP request. dotCMS addressed this vulnerability in version 26.04.28-03 by parameterizing the SQL query and adding Push Publish JWT token authentication to the affected endpoints.

Dotcms on Aretiq AI

CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection

1. Overview