CVE-2026-62251

Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283

Description The V4StatisticsQuery handler fails to call the sqlvalidator.ValidateRawSQL function when processing the user-supplied rawquery field, passing it directly to DuckDB. This allows an authenticated user to execute arbitrary SQL statements against all data accessible through the FlightSQL service, including VoIP call records, SIP messages, and metadata. The issue occurs at the /api/v4/statistics/query endpoint via the rawquery variable.

Recommendations Update to version 11.0.283. As a temporary workaround, restrict access to the /api/v4/statistics/query endpoint to minimize the risk of exploitation.