CVE-2026-108963: databasement RCE Vulnerability

CVE-2026-108963 Overview

CVE-2026-108963 is an argument injection vulnerability [CWE-88] in databasement versions prior to 1.8.2. The application invokes database backup utilities such as mariadb-dump using a database name that any authenticated user can control. Although shell quoting prevents classic operating system command injection, an attacker can inject additional command-line arguments such as --result-file=/app/public/index.php to write attacker-controlled content into web-accessible files. This leads to remote code execution within the application context.

Critical Impact
An authenticated user can achieve remote code execution by abusing argument injection in dump client invocations, writing executable PHP into the web root.

Affected Products

databasement versions before 1.8.2
Deployments using the MySQL/MariaDB backup service (app/Services/Backup/Databases/MysqlDatabase.php)
Deployments exposing database server configuration endpoints to authenticated users

Discovery Timeline

2026-10-11 - CVE-2026-108963 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108963

Vulnerability Analysis

The flaw resides in how databasement constructs the command line for mariadb-dump and related dump utilities. The database name field is user-controlled and passed as a positional argument. Because dump clients interpret any token beginning with -- as an option, an attacker-supplied value such as --result-file=/app/public/index.php is parsed as a flag rather than a database name. The dump client then writes its output to the attacker-chosen path.

Since databasement runs in a PHP application context with a public web root, writing to index.php or any .php file under public/ yields remote code execution. The attacker influences the file contents through the SQL dump output, which can include arbitrary table data.

Root Cause

The root cause is improper neutralization of argument delimiters, classified under [CWE-88] (Argument Injection). The pre-patch command construction in MysqlDatabase.php concatenated the database name using escapeshellarg(), which blocks shell metacharacters but does not prevent the dump binary from parsing the value as an option. No -- end-of-options separator was used, and no allow-list validated the database identifier.

Attack Vector

An authenticated user with permission to configure or trigger a database backup supplies a crafted database name. The downstream mariadb-dump or mysqldump invocation receives the injected flag and redirects its output to a path under the web root. The attacker then requests the resulting PHP file to execute code.

php

// Pre-patch command assembly (vulnerable)
$command = sprintf(
    '%s %s --host=%s --port=%s --user=%s --password=%s%s %s',
    $useMysqlClient ? self::MYSQL_DUMP_BINARY : self::DUMP_BINARY,
    implode(' ', $options),
    escapeshellarg($this->config['host']),
    escapeshellarg((string) $this->config['port']),
    escapeshellarg($this->config['user']),
    escapeshellarg($this->config['pass']),
    $extraFlags,
    escapeshellarg($this->config['database']), // attacker-controlled, parsed as option
);

$command .= ' > '.escapeshellarg($outputPath);

Source: GitHub Commit #22258e3

Detection Methods for CVE-2026-108963

Indicators of Compromise

Unexpected .php files or modifications in the application's public/ directory, especially index.php
Process execution events showing mariadb-dump or mysqldump invoked with a database name beginning with --
Dump client arguments containing --result-file=, --defaults-file=, --defaults-extra-file=, --defaults-group-suffix=, or --plugin-dir= originating from user input
Database server configuration changes with suspicious database field values

Detection Strategies

Monitor web server and PHP-FPM process ancestry for mariadb-dump or mysqldump child processes writing to web-accessible paths
Alert on file integrity changes to files under the databasementpublic/ directory outside of deployment windows
Parse application and shell audit logs for dump client command lines whose positional database argument starts with - or --

Monitoring Recommendations

Enable PHP auditd or equivalent process execution logging on hosts running databasement
Forward application logs and backup job logs to a centralized SIEM for correlation with file-write events
Baseline normal backup job command lines and alert on deviations in argument structure

How to Mitigate CVE-2026-108963

Immediate Actions Required

Upgrade databasement to version 1.8.2 or later immediately
Audit the public/ directory and application code for unauthorized modifications since the vulnerable version was deployed
Rotate database credentials stored in databasement if compromise is suspected
Review authenticated user accounts and revoke access for untrusted principals

Patch Information

The fix is delivered in two upstream commits. Commit 2d27619 introduces the SafeDumpFlags rule to reject dump options that control output location. Commit 22258e3 rejects abbreviated forms of denied options and reorders the dump command so the server-controlled --result-file=%s argument takes precedence over any attacker-supplied value:

php

// Post-patch command assembly
$command = sprintf(
    '%s %s --host=%s --port=%s --user=%s --password=%s%s --result-file=%s %s',
    $useMysqlClient ? self::MYSQL_DUMP_BINARY : self::DUMP_BINARY,
    implode(' ', $options),
    escapeshellarg($this->config['host']),
    escapeshellarg((string) $this->config['port']),
    escapeshellarg($this->config['user']),
    escapeshellarg($this->config['pass']),
    $extraFlags,
    escapeshellarg($outputPath),
    escapeshellarg($this->config['database']),
);

Full advisory details are available in GitHub Security Advisory GHSA-hm57-pvxc-4pcm.

Workarounds

Restrict access to the databasement application to trusted administrators until the patch is applied
Run the application under a user account that cannot write to the web root or any PHP-executable directory
Place the application behind an authenticating reverse proxy and block API endpoints that create or modify database server configurations

bash

# Example: ensure web root is not writable by the application runtime user
chown -R root:www-data /app/public
chmod -R 750 /app/public
find /app/public -type f -exec chmod 640 {} \;