{"id":"CVE-2026-59075","kind":"vulnerability","aliases":["CVE-2026-59075"],"related":[],"title":"Edito CMS: authenticated sort parameter injection leaks stored field values","description":"Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"Edito CMS passes the sort parameter of paginated admin endpoints into a Dynamic LINQ expression without proper validation. A logged-in attacker can read any field one character at a time by observing the order of returned results.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Edito CMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dotnet","edito-cms","other","self-hosted"],"not_affected_if":["auth-required","no-untrusted-accounts"],"how_to_check":"- Check the installed Edito CMS version against the fixed release `5.10.2607` or the 5.8 hotfix","fix":"- Edito CMS: upgrade to `5.10.2607`\n- Edito CMS 5.8: apply the hotfix released for that line (exact version not stated)","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:22+00:00","updated_at":"2026-11-13T08:45:22+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T08:45:22Z","model":"claude-haiku-5-5","output":{"fix":"- Edito CMS: upgrade to `5.10.2607`\n- Edito CMS 5.8: apply the hotfix released for that line (exact version not stated)","reach":"network","title":"Edito CMS: authenticated sort parameter injection leaks stored field values","impact":"medium","summary":"Edito CMS passes the sort parameter of paginated admin endpoints into a Dynamic LINQ expression without proper validation. A logged-in attacker can read any field one character at a time by observing the order of returned results.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","dotnet","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Secret field values readable by a logged-in attacker over time","analyst_note":"Confirm the affected version range and exact 5.8 hotfix version at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-59075) or the vendor advisory.","how_to_check":"- Check the installed Edito CMS version against the fixed release `5.10.2607` or the 5.8 hotfix\n- unknown for other checks; the sources do not name a file or setting to inspect","plain_action":"","product_name":"Edito CMS","needs_analyst":true,"not_affected_if":["auth-required","no-untrusted-accounts"],"who_is_affected":"Only Edito CMS installations where an attacker already holds an administrative or other account that can reach paginated admin endpoints. The sources do not describe a default-config trigger or any internet-only path, so the team should confirm which accounts can log in to the admin area.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4590,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59075':13A,16A '5.10.2607':124C '5.8':129C 'admin':35B 'administr':92C 'allow':99C 'also':131C 'analyz':94C 'attack':49B,81C,101C 'authent':3A,80C 'charact':55B,108C,110C 'cms':2A,18A,22B,28B,67C 'condit':84C 'cve':11A,14A 'data':117C 'dotnet':19B 'due':74C 'dynam':39B,71C 'edito':1A,17A,21B,27B,66C 'edito-cm':20B 'endpoint':36B,93C 'exposur':114C 'express':41B,85C 'extract':103C 'field':9A,53B,107C 'fix':121C 'host':26B 'hotfix':125C 'improp':76C 'inject':6A,73C,83C 'input':77C 'issu':119C 'lead':111C 'leak':7A 'linq':40B,72C 'log':47B 'logged-in':46B 'observ':60B 'older':127C 'one':54B 'order':62B,98C 'pagin':34B,91C 'paramet':5A,32B,89C 'pass':29B 'potenti':113C 'proper':43B 'read':51B 'releas':133C 'result':65B,97C 'return':64B,96C 'self':25B 'self-host':24B 'sensit':116C 'sort':4A,31B,88C 'store':8A 'time':58B 'valid':44B,78C 'valu':10A,104C 'version':123C,128C 'vulner':69C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Only Edito CMS installations where an attacker already holds an administrative or other account that can reach paginated admin endpoints. The sources do not describe a default-config trigger or any internet-only path, so the team should confirm which accounts can log in to the admin area.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cms","editocms"],"ptokens":["cms","edito"],"labels":["dotnet","editocms","high","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-59075':13A,16A 'authent':3A 'cms':2A,18A 'cve':11A,14A 'edito':1A,17A 'field':9A 'inject':6A 'leak':7A 'paramet':5A 'sort':4A 'store':8A 'valu':10A","search_b":"'admin':35B 'attack':49B 'charact':55B 'cms':22B,28B 'dotnet':19B 'dynam':39B 'edito':21B,27B 'edito-cm':20B 'endpoint':36B 'express':41B 'field':53B 'host':26B 'linq':40B 'log':47B 'logged-in':46B 'observ':60B 'one':54B 'order':62B 'pagin':34B 'paramet':32B 'pass':29B 'proper':43B 'read':51B 'result':65B 'return':64B 'self':25B 'self-host':24B 'sort':31B 'time':58B 'valid':44B 'without':42B","search_c":"'5.10.2607':124C '5.8':129C 'administr':92C 'allow':99C 'also':131C 'analyz':94C 'attack':81C,101C 'authent':80C 'charact':108C,110C 'cms':67C 'condit':84C 'data':117C 'due':74C 'dynam':71C 'edito':66C 'endpoint':93C 'exposur':114C 'express':85C 'extract':103C 'field':107C 'fix':121C 'hotfix':125C 'improp':76C 'inject':73C,83C 'input':77C 'issu':119C 'lead':111C 'linq':72C 'older':127C 'order':98C 'pagin':91C 'paramet':89C 'potenti':113C 'releas':133C 'result':97C 'return':96C 'sensit':116C 'sort':88C 'valid':78C 'valu':104C 'version':123C,128C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59075","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}