# CVE-2026-108963: databasement argument injection in database backup commands

Source: https://junglewise.ai/threats/cve-2026-108963-databasement-before-1-8-2-allows-remote-code-execution-because  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108963 · Severity: high · CVSS 8.8 · Published 2026-10-11

databasement is a Laravel application that manages database backups. Authenticated users can inject command-line arguments into database backup tools (like mariadb-dump), allowing them to write arbitrary files to the web server and execute code. An attacker with any valid application account can take over the server by modifying the application's index file.

Technologies: [David-Crty Databasement](https://junglewise.ai/threats/technologies/databasement). Vendors: [David-Crty](https://junglewise.ai/threats/vendors/david-crty).

## Quick answers

**Is CVE-2026-108963 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108963 being exploited in the wild.

**How severe is CVE-2026-108963?** High severity, with a CVSS score of 8.8, published 11 October 2026.

**Which products and versions are affected?** David-Crty Databasement before 1.8.2.

**Is there a fix for CVE-2026-108963?** Yes: fixed in 1.8.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108963 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108963?** Check whether you run David-Crty Databasement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.8.2

## Technical details

The vulnerability is an argument injection flaw in MysqlDatabase.php where authenticated users can control the database name parameter passed to mariadb-dump and similar tools. While the database name is quoted to prevent OS command injection, attackers can pass arguments like --result-file to redirect output to web-accessible paths. This enables arbitrary file write and indirect code execution without requiring shell metacharacters.

## Affected products

- David-Crty databasement before 1.8.2

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php](https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php)
- [https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json](https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json)

## Related threats

- [Databasement authentication bypass in OAuthService](https://junglewise.ai/threats/cve-2026-121939-databasement-before-1-10-9-contains-an-authentication-bypass)
- [Databasement missing authorization in scheduled restore](https://junglewise.ai/threats/cve-2026-111875-a-vulnerability-has-been-found-in-david-crty-databasement-up-to)
- [David-Crty databasement improper access control in Snapshot API](https://junglewise.ai/threats/cve-2026-103534-a-vulnerability-was-determined-in-david-crty-databasement-up-to)
- [David-Crty databasement path traversal in RestoreRequest](https://junglewise.ai/threats/cve-2026-103533-a-vulnerability-was-found-in-david-crty-databasement-up-to-1-7-1)
- [Databasement token validation bypass in invitation acceptance](https://junglewise.ai/threats/cve-2026-95654-databasement-before-1-7-14-validates-invitation-tokens-only-when)