---
id: "CVE-2026-62362"
kind: "vulnerability"
aliases: ["CVE-2026-62362"]
title: "PeerBanHelper: authenticated SQL injection through statistics field parameter exposes database"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mysql", "package", "peerbanhelper", "postgresql", "self-hosted", "sqlite"]
not_affected_if: ["no-authenticated-users-besides-admin", "version-9.3.15-or-later"]
published_at: "2026-10-16T17:17:35+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:32:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62362", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# PeerBanHelper: authenticated SQL injection through statistics field parameter exposes database

PeerBanHelper, a BitTorrent peer-blocking tool, passes an unsanitized field query parameter from its statistics analysis endpoint directly into SQL queries. An authenticated user can read all data in the PeerBanHelper database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PeerBanHelper version; versions from 5.0.0 up to but not including `9.3.15` are affected
- Confirm whether the web interface or API is reachable beyond trusted users, since exploitation requires an authenticated account

## Fix

- Upgrade PeerBanHelper to `9.3.15`
- Until upgraded, restrict access to the web interface and rotate any credentials stored in the database

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62362

## From the sources

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_