---
id: "CVE-2026-59075"
page: "https://infrastack.ai/live/CVE-2026-59075"
kind: "vulnerability"
aliases: ["CVE-2026-59075"]
title: "Edito CMS: authenticated sort parameter injection leaks stored field values"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Edito CMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dotnet", "edito-cms", "other", "self-hosted"]
not_affected_if: ["auth-required", "no-untrusted-accounts"]
published_at: "2026-11-13T08:17:17+00:00"
first_seen_at: "2026-11-13T08:44:24+00:00"
updated_at: "2026-11-13T08:45:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59075", "first_seen_at": "2026-11-13T08:44:24+00:00"}]
exploit_sources: []
---

# Edito CMS: authenticated sort parameter injection leaks stored field values

Link for people: https://infrastack.ai/live/CVE-2026-59075 (this .md is for agents)

Edito CMS passes the sort parameter of paginated admin endpoints into a Dynamic LINQ expression without proper validation. A logged-in attacker can read any field one character at a time by observing the order of returned results.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Edito CMS affected range not listed fixed no fixed version listed

## How to check

- Check the installed Edito CMS version against the fixed release `5.10.2607` or the 5.8 hotfix

## Fix

- Edito CMS: upgrade to `5.10.2607`
- Edito CMS 5.8: apply the hotfix released for that line (exact version not stated)

## Timeline

- 2026-11-13T08:44:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59075

## From the sources

Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.


This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_