EDITO CMS · CVE-2026-59075 · Other
NO FIX YET · SEE WHAT TO DO
Edito CMS passes the sort parameter of paginated admin endpoints into a Dynamic LINQ expression without proper validation. A logged-in attacker can read any field one character at a time by observing the order of returned results.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only Edito CMS installations where an attacker already holds an administrative or other account that can reach paginated admin endpoints. The sources do not describe a default-config trigger or any internet-only path, so the team should confirm which accounts can log in to the admin area.
Not affected if auth-required, no-untrusted-accounts
Who cares dotnet, edito-cms, self-hosted
5.10.2607 or the 5.8 hotfix5.10.2607Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.