CVE-2026-25947: Worklenz SQL Injection Vulnerability

CVE-2026-25947 Overview

CVE-2026-25947 is a critical SQL Injection vulnerability affecting Worklenz, an open-source project management tool. Prior to version 2.1.7, multiple SQL injection vulnerabilities were discovered in the backend SQL query construction, impacting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. These vulnerabilities allow authenticated attackers to manipulate database queries and potentially access, modify, or delete sensitive data.

Critical Impact

Attackers with low-privilege access can exploit SQL injection flaws to bypass authorization controls, exfiltrate sensitive project data, modify financial records, and potentially compromise the entire database backend.

Affected Products

• Worklenz versions prior to 2.1.7
• Worklenz backend components using unsanitized SQL query construction
• Worklenz socket.io real-time handlers

Discovery Timeline

• 2026-02-10 - CVE-2026-25947 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25947

Vulnerability Analysis

The vulnerability stems from improper input validation and direct string interpolation in SQL query construction across multiple Worklenz backend components. The affected code paths include project and task management controllers, reporting endpoints, financial data handlers, real-time socket.io event processors, and resource allocation features.

The attack requires network access and low-privilege authentication to the Worklenz application. Once authenticated, an attacker can inject malicious SQL statements through various input parameters that are directly concatenated into database queries without proper sanitization or parameterization. This can lead to complete compromise of data confidentiality, integrity, and availability within the application's database.

Root Cause

The root cause is the use of string interpolation to construct SQL queries rather than using parameterized queries or prepared statements. User-controlled input was directly embedded into SQL query strings using template literals, allowing attackers to break out of the intended query context and inject arbitrary SQL commands.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which describes scenarios where software constructs SQL commands using externally-influenced input without properly neutralizing special characters that could modify the intended SQL command.

Attack Vector

The attack vector is network-based, requiring an authenticated user with low privileges to submit specially crafted input through various API endpoints and socket.io handlers. The socket.io timer functionality was particularly vulnerable, as user-controlled task_id values were directly interpolated into complex PostgreSQL queries without validation.

The following code excerpt demonstrates the vulnerable pattern found in the socket.io timer stop handler, where user input was directly interpolated into SQL queries:

   try {
     const body = JSON.parse(data as string);
     const userId = getLoggedInUserIdFromSocket(socket);
-    const q = `
-    DO
-    $$
-        DECLARE
-            _start_time TIMESTAMPTZ;
-            _time_spent NUMERIC;
-        BEGIN
-
-            SELECT start_time FROM task_timers WHERE user_id = '${userId}' AND task_id = '${body.task_id}' INTO _start_time;
-
-            _time_spent = COALESCE(EXTRACT(EPOCH FROM
-                                           (DATE_TRUNC('second', (CURRENT_TIMESTAMP - _start_time::TIMESTAMPTZ)))::INTERVAL),
-                                   0);
-
-            IF (_time_spent > 0)
-            THEN
-                INSERT INTO task_work_log (time_spent, task_id, user_id, logged_by_timer, created_at)
-                VALUES (_time_spent, '${body.task_id}', '${userId}', TRUE, _start_time);
-            END IF;
-
-            DELETE FROM task_timers WHERE user_id = '${userId}' AND task_id = '${body.task_id}';
-        END
-    $$;
-    `;
-    await db.query(q, []);
+    
+    // Validate inputs

Source: GitHub Commit Update

The fix introduced proper input validation through a SqlHelper utility class:

 import { IWorkLenzRequest } from "../../interfaces/worklenz-request";
 import { IWorkLenzResponse } from "../../interfaces/worklenz-response";
 import { ServerResponse } from "../../models/server-response";
+import { SqlHelper } from "../../shared/sql-helpers";
 import { TASK_PRIORITY_COLOR_ALPHA, TASK_STATUS_COLOR_ALPHA, UNMAPPED } from "../../shared/constants";
 import { getColor } from "../../shared/utils";
 import PtTasksControllerBase, { GroupBy, ITaskGroup } from "./pt-tasks-controller-base";

Source: GitHub Commit Update

Detection Methods for CVE-2026-25947

Indicators of Compromise

• Unusual database query patterns containing SQL metacharacters such as single quotes, semicolons, or SQL keywords in task_id or user_id parameters
• Unexpected database errors or exceptions logged from project management, reporting, or socket.io endpoints
• Evidence of data exfiltration attempts through time-based or error-based SQL injection techniques
• Anomalous access patterns to financial data or reporting endpoints from low-privilege users

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common SQL injection patterns in HTTP requests and WebSocket messages
• Monitor application logs for SQL syntax errors, unexpected query results, or database connection anomalies
• Deploy database activity monitoring to identify unusual query patterns, especially those involving UNION, SELECT, or data manipulation statements
• Enable audit logging on the Worklenz database to track query execution and identify suspicious activity

Monitoring Recommendations

• Configure alerting for multiple failed database queries from single user sessions
• Monitor socket.io connection handlers for malformed JSON payloads containing SQL injection attempts
• Implement rate limiting on API endpoints to slow down automated exploitation attempts
• Review access logs for repeated requests to vulnerable endpoints with varying input parameters

How to Mitigate CVE-2026-25947

Immediate Actions Required

• Upgrade Worklenz to version 2.1.7 or later immediately to remediate all identified SQL injection vulnerabilities
• Audit database access logs for any evidence of exploitation prior to patching
• Review and rotate database credentials if compromise is suspected
• Implement network segmentation to restrict database access to only authorized application servers

Patch Information

The vulnerability has been patched in Worklenz version v2.1.7. The fix introduces the SqlHelper utility class for proper input validation and refactors SQL query building across all affected controllers and socket.io handlers.

For detailed patch information, refer to:

• GitHub Release v2.1.7
• GitHub Commit Update
• GitHub Security Advisory GHSA-f2f8-2ppj-85pf

Workarounds

• Deploy a web application firewall (WAF) with SQL injection detection rules in front of the Worklenz application
• Restrict network access to the Worklenz instance to trusted IP ranges only
• Implement database-level query logging and monitoring to detect exploitation attempts
• Consider temporarily disabling real-time socket.io features until the patch can be applied

# Configuration example - WAF rule for SQL injection detection (ModSecurity)
SecRule ARGS "@detectSQLi" "id:1,phase:2,deny,status:403,log,msg:'SQL Injection Detected'"
SecRule REQUEST_BODY "@detectSQLi" "id:2,phase:2,deny,status:403,log,msg:'SQL Injection in Request Body'"