CVE-2026-108963 - Exploits & Severity

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

databasement before version 1.8.2 allows remote code execution through argument injection when executing database commands. The vulnerability occurs because authenticated users can specify arbitrary database names that are passed as arguments to commands like mariadb-dump. By injecting malicious arguments such as --result-file=/app/public/index.php, an attacker can write files to arbitrary locations on the server and achieve code execution.

Any authenticated user over the network can inject arguments into database commands to write arbitrary files to the server filesystem, enabling them to execute arbitrary code on the server.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch is available in version 1.8.2 and later.

Upgrade databasement to version 1.8.2 or later. Implement input validation and sanitization on database name parameters to prevent argument injection. Consider restricting network access to the databasement application to trusted users only. Review server file permissions to limit the impact of unauthorized file writes.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Feedly found the first article mentioning CVE-2026-108963 . See article

NVD published the first details for CVE-2026-108963

A CVSS base score of 8.8 has been assigned.

GitHub Advisories released a security advisory .

[GHSA-7cxh-ppfp-4mq4] databasement before 1.8.2 allows remote code execution because it runs certain c

CVE-2026-108963 - Databasement Argument Injection Remote Code Execution CVE ID : CVE-2026-108963 Published : Oct. 11, 2026, 8:16 p.m. | 1 hour, 14 minutes ago Description : databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mar...

CVE Record: CVE-2026-108963

[GHSA-7cxh-ppfp-4mq4] databasement before 1.8.2 allows remote code execution because it runs certain c

CVE-2026-108963: other words Remote Code Execution (RCE) - Analysis & Fix

Be the first to know critical vulnerabilities

Collect, analyze, and vulnerability reports faster using AI