CVE-2026-72550

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev

Description An SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL statements. This occurs because the order parameter in the 'photo-view' endpoint is concatenated unescaped into a SHOW COLUMNS query using a bare PDO::query() call, which enables stacked statement injection. This allows an attacker to read, modify, or delete the entire database.

Recommendations Update Friendica to a version later than 2026.08-dev. Avoid using the order parameter in the 'photo-view' endpoint until the update is applied.