CVE-2026-9059
Last modified
CVE-2026-9059 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-9059?
How severe is CVE-2026-9059?
How do I fix CVE-2026-9059?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9051There is an authentication bypass vulnerability in the NI Sy…9.3
- CVE-2026-9053Mothra would respect a default value given by a website for …6.9
- CVE-2026-9054An attacker sending tcp, il, rudp, rudp, or gre packets with…9.2
- CVE-2026-9056A stored cross-site scripting vulnerability has been found i…5.4
- CVE-2026-9057A broken access control issue has been identified in the Tal…8.2
- CVE-2026-9058For untrusted certificates that contain the "Authority Infor…9.3
- CVE-2026-9060The Store Locator WordPress plugin before 1.6.6 does not san…3.5
- CVE-2026-9061The Store Locator WordPress plugin before 1.6.9 does not san…3.5
- CVE-2026-9062The Store Locator WordPress plugin before 1.6.9 does not val…3.4
- CVE-2026-9064A flaw was found in 389-ds-base. The get_ldapmessage_control…7.5
- CVE-2026-9065SureCart version prior to 4.2.1 are vulnerable to authentica…9.3
- CVE-2026-9066The WP Compress WordPress plugin before 7.10.04 does not va…6.1
Are you affected by CVE-2026-9059?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST