CVE-2026-40330: Masa CMS SQL Injection via beanFeed.cfc sortDirection Parameter
GitHub's advisory GHSA-56cc-gxfr-hqp8 describes a critical SQL injection in the beanFeed.cfc component of Masa CMS, triggered through the sortDirection parameter. The record lists affected versions from 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9 and 7.5.0 through 7.5.2, with fixes in 7.2.10, 7.3.15, 7.4.10 and 7.5.3. Upgrading to the fixed release of each branch is the primary remedy, and no confirmed exploitation appears in the sources consulted.
Overview
Masa CMS is an open source content management system. The GitHub Security Advisory GHSA-56cc-gxfr-hqp8 describes an SQL injection flaw (CWE-89) in the beanFeed.cfc component, within the getQuery function. The value of the sortDirection parameter is concatenated directly into SQL queries without sanitization or parameterization.
Impact
According to the record, an unauthenticated remote attacker could extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server. GitHub assigned a CVSS 4.0 base score of 9.3 (critical). The vector in the record reflects network reachability, low complexity, no privileges and no user interaction required, with high impact to confidentiality, integrity and availability.
Affected products and versions
The description identifies the following ranges as affected:
- Masa CMS 7.2.0 through 7.2.9
- Masa CMS 7.3.0 through 7.3.14
- Masa CMS 7.4.0 through 7.4.9
- Masa CMS 7.5.0 through 7.5.2
The structured affected and fixes fields in the record are empty, so these ranges come from the narrative description only.
Exploitation status
The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS record shows a probability of 0.00658 with a percentile of 0.50177, which is an estimate of exploitation likelihood and not a confirmation of attacks.
Remediation and mitigation
- Upgrade to the fixed release for your branch: 7.2.10, 7.3.15, 7.4.10 or 7.5.3.
- If an upgrade cannot be applied immediately, the advisory workaround is to use a web application firewall to block or restrict access to the beanFeed.cfc component, or to deploy rules that detect SQL injection patterns aimed at the sortDirection parameter.
- Limit exposure of the CMS to only the networks and users that need it, and review which endpoints are reachable from the internet.
- Verify the installed version after patching and confirm that the workaround rules are active.
Detection guidance
- Review web server and application logs for requests to beanFeed.cfc that contain unusual or malformed values in the sortDirection parameter.
- Monitor database logs for syntax errors or unexpected query patterns originating from the CMS application account.
- Alert on unexpected changes to content or data tables that the CMS does not normally modify.
Limitations of the available information
- The record does not contain structured affected or fixed product entries, so version coverage relies on the description.
- The record does not state whether other branches outside the listed ranges are affected or fixed; this is unknown.
- No technical proof-of-concept or vendor timeline details are included in the sources consulted.
- The source status of the record is marked Deferred, so the information may change as the advisory is updated.
Frequently asked questions
Which Masa CMS versions are fixed for CVE-2026-40330?
The record lists fixes in versions 7.2.10, 7.3.15, 7.4.10 and 7.5.3. Apply the fix that matches your installed branch.
Is CVE-2026-40330 listed as exploited in the wild?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.