Executive brief
Masa CMS is an open-source platform used to manage website content. A critical security flaw allows unauthorized individuals to bypass security controls and access the website's underlying database. This could lead to the theft of sensitive information, including administrator passwords, and potentially allow attackers to take full control of the website or disrupt its operations.
Technical details
A critical SQL injection vulnerability exists in Masa CMS due to improper neutralization of the 'altTable' parameter within the unauthenticated JSON API. The 'setAltTable()' method in 'feedBean.cfc' stores user input without sanitization, which is then directly injected into a SQL FROM clause in 'feedGateway.cfc'. An unauthenticated remote attacker can exploit this by passing arbitrary subqueries to read sensitive data from any database table, including 'tusers' for administrative credentials and 'tredirects' for password reset tokens. This access can be further leveraged to achieve Remote Code Execution (RCE) by uploading malicious plugins via the administrative interface. Patches are available in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.
Affected products
- MasaCMS Masa CMS 7.2.0 - 7.2.9, 7.3.0 - 7.3.14, 7.4.0 - 7.4.9, 7.5.0 - 7.5.2
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published by MasaCMS
- 2026-05-05: disclosed: CVE-2026-40331 published to NVD