# CVE-2026-8054: dotCMS Core SQL injection in Publish Audit API

Source: https://junglewise.ai/threats/cve-2026-8054-dotcms-core-sql-injection-in-publish-audit-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-8054 · Severity: info · CVSS 10 · Published 2026-05-27

dotCMS, a content management system used to power corporate websites and applications, contains a critical vulnerability in its Publish Audit API. This flaw allows an unauthenticated attacker to remotely access or modify the underlying database without a password. Successful exploitation could lead to the theft of sensitive customer data, unauthorized modification of website content, or the complete destruction of database records.

Technologies: [dotCMS](https://junglewise.ai/threats/technologies/dotcms). Vendors: [dotCMS](https://junglewise.ai/threats/vendors/dotcms).

## Quick answers

**Is CVE-2026-8054 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8054 being exploited in the wild.

**How severe is CVE-2026-8054?** Informational severity, with a CVSS score of 10, published 27 May 2026.

**Which products and versions are affected?** dotCMS 25.11.04-1 through 26.04.28-02.

**Is there a fix for CVE-2026-8054?** A patch was published on 2026-05-04: Pull request to parameterize queries merged into main branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8054 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8054?** Check whether you run dotCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) of dotCMS Core. The root cause is the improper neutralization of the 'bundle-id' parameter within the getPublishAuditStatuses method, where input was manually wrapped in single quotes and formatted into a dynamic SQL IN clause without parameterization. Because these endpoints did not enforce authentication, a remote attacker can execute arbitrary SQL commands against the backend database. The vulnerability is fixed in version 26.04.28-03 by implementing parameterized queries and enforcing backend user permissions. LTS releases are reportedly unaffected.

## Affected products

- dotCMS dotCMS Core 25.11.04-1 through 26.04.28-02

## Timeline

- 2026-05-04: patched: Pull request to parameterize queries merged into main branch.
- 2026-05-27: advisory: CVE-2026-8054 published.

## References

- [https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75](https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75)
- [https://github.com/dotCMS/core/pull/35553](https://github.com/dotCMS/core/pull/35553)

## Related threats

- [dotCMS privilege escalation and RCE in ToolGroupResource and RoleAjax](https://junglewise.ai/threats/cve-2026-16337-dotcms-privilege-escalation-and-rce-in-toolgroupresource-and)
- [dotCMS Unrestricted Upload of File Vulnerability](https://junglewise.ai/threats/cve-2022-26352-dotcms-unrestricted-upload-of-file-vulnerability)