CVE-2026-82039

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16

Description An issue exists in the searchQueryBuilder() function of UtmAssetGroupService where authenticated attackers can inject arbitrary SQL. This occurs because the assetType and groupName variables are inserted unsanitized into a native PostgreSQL query using String.format(). Exploitation of the GET '/api/utm-asset-groups/searchGroupsByFilter' endpoint allows the execution of arbitrary SQL with DBA privileges, which can lead to full database read, data modification, and potential filesystem access.

Recommendations Update UTMStack to version 11.2.16 or later. Avoid using the assetType and groupName variables in the '/api/utm-asset-groups/searchGroupsByFilter' endpoint until the update is applied.