# CVE-2026-54597: ITFlow SQL injection in credential share link generation

Source: https://junglewise.ai/threats/cve-2026-54597-itflow-sql-injection-in-credential-share-link-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54597 · Severity: high · CVSS 8.3 · Published 2026-09-17

ITFlow is an IT documentation and ticketing system used by managed service providers to manage customer data, credentials, and support tickets. An authenticated attacker with appropriate permissions can exploit a time-based SQL injection flaw to extract sensitive information including password hashes, SMTP credentials, API keys, and encrypted vault data, potentially leading to account takeover and administrative access.

Technologies: [ITFlow](https://junglewise.ai/threats/technologies/itflow). Vendors: [ITFlow](https://junglewise.ai/threats/vendors/itflow).

## Quick answers

**Is CVE-2026-54597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54597 being exploited in the wild.

**How severe is CVE-2026-54597?** High severity, with a CVSS score of 8.3, published 17 September 2026.

**Which products and versions are affected?** ITFlow prior to 26.07.

**Is there a fix for CVE-2026-54597?** A patch was published on 2026-07-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54597 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54597?** Check whether you run ITFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based blind SQL injection vulnerability exists in the share_generate_link handler (agent/ajax.php) where the expires parameter is improperly sanitized before insertion into a MySQL INTERVAL expression. The sanitizeInput function applies only string-context escaping, but since the parameter is inserted unquoted into the item_expire_at INTERVAL calculation, an attacker can craft a malicious expression to execute conditional database queries. The vulnerability requires authentication and the module_support write permission plus access to a credential record. By analyzing response delays, an attacker can infer database contents and extract sensitive data including credential hashes and encryption keys. The issue is fixed in version 26.07 by using intval() type casting on the expires parameter.

## Affected products

- ITFlow ITFlow prior to 26.07

## Timeline

- 2026-09-17: disclosed
- 2026-07-01: patched

## References

- [https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf](https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf)
- [https://github.com/itflow-org/itflow/pull/1289](https://github.com/itflow-org/itflow/pull/1289)

## Related threats

- [ITFlow SVG attachment upload in ticket email parser](https://junglewise.ai/threats/cve-2026-97735-itflow-before-26-08-allows-svg-attachments-in-the-ticket-email)
- [ITFlow SQL injection in recurring invoice frequency parameter](https://junglewise.ai/threats/cve-2026-54596-itflow-sql-injection-in-recurring-invoice-frequency-parameter)
- [ITFlow authorization bypass in credential edit modal](https://junglewise.ai/threats/cve-2026-47755-itflow-authorization-bypass-in-credential-edit-modal)