CVE-2026-96634

Summary

Analysis

$query = get file("sql file", true, ";");

User uploads a malicious SQL file through the import form. The file content is read into the $query variable without any initial sanitization.

// Query parsing loop that extracts individual SQL statements

The uploaded SQL content is processed in a loop that splits it into individual queries. Each query $query is extracted for processing.

$space = "(?:s|/*[sS]*?*/|(?:#|$line comment)[^
]*
?|--r?
)";

Definition of the $space regex pattern used in the ATTACH filter. The possessive quantifier *+ combined with SQLite comment patterns (--) creates the catastrophic backtracking vulnerability when many comment lines are processed.

if (DIALECT == "sqlite" && preg match("~^$space*+ATTACHb~i", $q, $match)) {

The ATTACH query filter check. When the regex encounters 350,000 SQLite comment lines (--), it triggers catastrophic backtracking. The possessive quantifier *+ causes exponential backtracking, eventually hitting PHP's backtracking limit and causing preg match() to return false instead of 0 or 1, bypassing the security filter.

Connection::get()->multiQuery($q)

When the ATTACH filter is bypassed due to the preg match() returning false, the malicious SQL query containing the ATTACH statement is executed. This allows the attacker to create a .php file with embedded PHP code, achieving remote code execution when the file is accessed via HTTP.