Masa CMS SQL injection via sortDirection parameter in beanFeed

{
  "id": "766d6c8c8a042eb3fe2988196a87e8ba48b6240c8f8f2227397922df7a7f5fb8",
  "url": "https://osv.dev/vulnerability/CVE-2026-40330",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Masa CMS SQL injection via sortDirection parameter in beanFeed",
    "summary": "Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, use a WAF to block or restrict access to the beanFeed.cfc component, or deploy rules to detect SQL injection patterns targeting the sortDirection parameter.",
    "evidence": "osv:CVE-2026-40330",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-40330",
      "aliases": [
        "CVE-2026-40330",
        "GHSA-56cc-gxfr-hqp8"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/masacms/masacms",
              "type": "GIT",
              "events": [
                {
                  "introduced": "ea9dd65d88ba55d5b41131cf355778a6529ff42a"
                },
                {
                  "last_affected": "860e7ce75059195f25bc0ccc6e44a464e05a56fb"
                },
                {
                  "introduced": "0"
                },
                {
                  "fixed": "32e14628f9784ab4059cc77d89e21222129c02a1"
                },
                {
                  "introduced": "53d53e7c120068ce1102215805238ab19027fb58"
                },
                {
                  "last_affected": "86f9490fd0dbbcd5c5c4848f908b84bd38c5a6bd"
                },
                {
                  "introduced": "0587433f237af2b04cc2e03e5f08f0300f36d253"
                },
                {
                  "last_affected": "44815bfe904a6470d977de4b776bea0cf913a13c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "7.2.0"
                      },
                      {
                        "last_affected": "7.2.9"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "range": [
                      {
                        "introduced": "7.3.0"
                      },
                      {
                        "last_affected": "7.3.14"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.2.10"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "range": [
                      {
                        "introduced": "7.4.0"
                      },
                      {
                        "last_affected": "7.4.9"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "range": [
                      {
                        "introduced": "7.5.0"
                      },
                      {
                        "last_affected": "7.5.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "7.2.9",
            "7.4.9",
            "7.5.2",
            "7.2.8",
            "7.4.8",
            "7.5.1",
            "7.5.0",
            "7.4.7",
            "7.4.6",
            "7.2.7",
            "7.4.4",
            "7.2.6",
            "7.4.3",
            "7.4.2",
            "7.4.1",
            "7.2.5",
            "7.4.0",
            "7.2.4",
            "7.2.3",
            "7.2.2",
            "7.2.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40330.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:41.212084638Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40330.json",
        "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-56cc-gxfr-hqp8",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-40330"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-89"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40330.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-40330",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 508876,
  "published_at": "2026-05-05T19:46:03.832+00:00"
}