What is CVE-2026-8054?

CVE-2026-8054 is a vulnerability in Dotcms Core, classified under SQL Injection. Published 2026-05-27.

Is CVE-2026-8054 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Dotcms Core

CVE-2026-8054

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote…

Vulnerability class: SQL Injection

EPSS: 0.016 (72.9th percentile) — read the EPSS interpretation.

Affected products

Dotcms Core — versions 25.11.04-1, 26.04.28-03

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

Mr-xn/CVE-2026-8054

References

security@dotcms.com (vendor-advisory)
security@dotcms.com (patch)

Frequently asked questions

What is CVE-2026-8054?: CVE-2026-8054 is a vulnerability in Dotcms Core, classified under SQL Injection. Published 2026-05-27.
Is CVE-2026-8054 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.