CVE-2026-40329: Masa CMS SQL Injection in beanFeed.cfc sortBy Parameter
Masa CMS versions 7.5.2 and earlier contain an SQL injection flaw in the sortBy parameter processed by the getQuery function of beanFeed.cfc. According to the record, an unauthenticated remote attacker could run arbitrary SQL against the database. Fixes are reported in versions 7.2.10, 7.3.15, 7.4.10 and 7.5.3, and a WAF-based workaround is described.
Overview
Masa CMS is an open source content management system. According to the GitHub Security Advisory, versions 7.5.2 and earlier contain an SQL injection flaw in the sortBy parameter handled by the getQuery function of the beanFeed.cfc component. The record classifies the weakness as CWE-89.
Impact
The advisory describes an unauthenticated remote attacker who could run arbitrary SQL commands against the database. The record lists potential consequences including access to sensitive data, modification or deletion of records, and escalation to administrative control. The actual impact in a given deployment depends on database permissions and configuration, which the record does not describe.
- The CVSS 4.0 base score reported by GitHub is 9.3, rated critical.
- The vector rates confidentiality, integrity and availability impacts as high.
Affected products and versions
- Masa CMS 7.5.2 and earlier, as stated in the advisory.
- The record does not contain a structured list of affected versions, so the status of older releases is unknown.
The reported fixed versions are 7.2.10, 7.3.15, 7.4.10 and 7.5.3.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The record reports an EPSS probability of 0.00511 and a percentile of 0.41999.
Remediation and mitigation
- Upgrade to the fixed version that matches your release line: 7.2.10, 7.3.15, 7.4.10 or 7.5.3, or a later release.
- If an immediate upgrade is not possible, the advisory suggests web application firewall rules that block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc. A WAF is a temporary measure and does not replace patching.
- Review the database account privileges used by the application to limit the effect of any injection.
Detection guidance
- Review web server and application logs for requests to beanFeed.cfc that carry unusual or unexpected values in the sortBy parameter.
- Monitor database logs for errors or queries that do not match normal application behaviour.
- Check for unexpected changes to administrative accounts or content.
Limitations of the available information
The record does not include affected or fixed products beyond Masa CMS, patch diffs, or vendor-specific configuration details. The record's published date and EPSS date should be verified against the live sources. Reachability in a given deployment depends on factors not covered here.
Frequently asked questions
Is CVE-2026-40329 being actively exploited?
No confirmed exploitation in the wild appears in the sources consulted. The record shows the CVE is not listed in the CISA KEV catalog.
Which versions are affected?
The advisory states Masa CMS 7.5.2 and earlier. The reported fixed versions are 7.2.10, 7.3.15, 7.4.10 and 7.5.3.
What should administrators do first?
Upgrade to the fixed release for your release line. If that is not immediately possible, apply WAF rules as a temporary workaround and monitor logs.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.