CVE-2026-108087
Received Received - Intake

Improper SQL Injection in Apache Cocoon

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-108087
EUVD
EUVD-2026-104912

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Cocoon 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL injection vulnerability in Apache Cocoon, a retired web development framework. It occurs because user input is not properly sanitized before being used in SQL commands. Attackers could exploit this to inject malicious SQL code, potentially accessing or manipulating database contents.

Detection Guidance

Since Apache Cocoon is unsupported and no longer maintained, detection may involve checking for active instances of the software on your network. Look for endpoints using Apache Cocoon by inspecting web server configurations or logs for references to Cocoon paths or components. No specific commands are provided as the project is retired and lacks official detection guidance.

Impact Analysis

If you are still using Apache Cocoon, an attacker could exploit this to read, modify, or delete sensitive data in your database. Since the project is retired, no official fixes will be released. The best course is to stop using it or restrict access to trusted users only.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance risks include fines, legal action, and reputational damage. Using unsupported software exacerbates these risks.

Mitigation Strategies

Immediately restrict access to Apache Cocoon instances to trusted users only. Consider migrating to an actively supported alternative as the project is retired and no fixes will be released. Disable or remove any exposed Cocoon instances from your network to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart