CVE-2026-22242: CoreShop Vulnerable to SQL Injection via Admin Reports

January 7, 2026 (updated January 12, 2026)

A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

References

github.com/advisories/GHSA-ch7p-mpv4-4vg4
github.com/coreshop/CoreShop
github.com/coreshop/CoreShop/commit/59e84fec59d113952b6d28a9b30c6317f9e6e5dd
github.com/coreshop/CoreShop/security/advisories/GHSA-ch7p-mpv4-4vg4
nvd.nist.gov/vuln/detail/CVE-2026-22242

Code Behaviors & Features

Detect and mitigate CVE-2026-22242 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →