CVE-2026-53448

Katalog CVE

CVSS 7.2 · High EPSS 0,70%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada coturn project coturn. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. This issue is fixed in version 4.12.0.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/coturn/coturn/security/advisories/GHSA-v8hj-2xx7-xmp5 exploit · advisory vendor
• https://github.com/coturn/coturn/commit/b84dbab1d1aa6e2bf0211a1cdbb250d6de2a0d09 patch
• https://github.com/coturn/coturn/pull/1924 issue tracking · patch
• https://github.com/coturn/coturn/releases/tag/4.12.0 release notes