Junglewise Threat Intelligence

CVE-2026-38626: Garlic-Hub SQL injection in ItemsRepository

CVE-2026-38626 · Severity: critical · CVSS 9.8 · Published 2026-09-10

Executive brief

Garlic-Hub is a digital signage management application. A SQL injection vulnerability in the Items module allows unauthenticated attackers to execute arbitrary database queries, potentially exposing or modifying sensitive data stored in the system's database.

Technical details

A SQL injection vulnerability (CWE-89) exists in src/Modules/Items/Repositories/ItemsRepository.php due to unsafe string concatenation of user input (the $owner variable) into a SQL query. The vulnerable code directly concatenates the $owner parameter into the query builder without parameterized statements or sanitization. An attacker can exploit this via time-based blind SQL injection attacks, as demonstrated by forcing a 5-second server delay, which confirms ability to execute arbitrary SQL. The vulnerability allows full database read/write access depending on the application's database privileges.

Affected products

  • Garlic-Hub Garlic-Hub v1.0.1

Timeline

  • 2026-03-23: disclosed: Vulnerability discovered and reported by Gaurish Bahurupi
  • 2026-09-10: advisory: CVE-2026-38626 published

References