CVE-2026-108087: vulnerability in Apache Cocoon
Apache Cocoon: SQL Injection
Published
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
exploitation probability
—
observed exploitation
nono source reports it
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions.
Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected products
Apache Software Foundation · Apache CocoonRelated CVEs — Apache Cocoon
In the same product, most dangerous first.
CVE-2023-49733—Apache Cocoon's StreamGenerator is vulnerable to XXE injectionEPSS 1.3%CVE-2022-45135CRITICALApache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionEPSS 1.1%CVE-2025-24783HIGHApache Cocoon: continuations may not be privateEPSS 0.8%CVE-2026-108089HIGHApache Cocoon: Unauthenticated access to diagnostic interfacesEPSS —CVE-2026-108088—Apache Cocoon: Cross-user cache poisoningEPSS —CVE-2026-108086—Apache Cocoon: XEE could lead to SSRF and information disclosureEPSS —