CVE-2026-19355

CVE-2026-19355 is a SQL injection in the MCMS content management system's `ModelDataImpl.queryDiyFormData` endpoint, specifically via the `formFields` parameter on `/mdiy/form/data/list.do`. The vulnerability is exploitable without authentication over the network, which is why CVSS assigns 7.3. But the score misses what makes this actually dangerous: there's a working public exploit, the vendor is unresponsive, and the project appears abandoned with no patch coming. The most likely remediation path is a field-name whitelist—which solves the immediate SQLi but creates a secondary risk. A whitelist only works if it's actively maintained as form schemas evolve. Any field name not on the whitelist gets rejected, but valid field names can often be enumerated from documentation, error messages, or application behavior. That means the 'fix' becomes its own information-leak vector, and any new form field added without updating the whitelist reintroduces the original vulnerability under the guise of 'already patched.' If you're running MCMS, your realistic options are: (1) block the endpoint at the network layer or WAF if you don't use the form-builder feature, (2) implement strict allowlisting on `formFields` that only permits known-safe field names, or (3) decommission the instance entirely. The third option is worth taking seriously. CVSS assumes a functioning disclosure-and-patch lifecycle—temporal metrics encode the expectation that a fix will eventually arrive. When the vendor is gone and the project is abandoned, those assumptions break. The defender position degrades over time as exploit tooling absorbs this CVE into automated frameworks. Your window for 'adequate' compensating controls shrinks with each passing month. A concrete decommissioning timeline is the only mitigation that doesn't depend on maintaining forever-running exceptions to a codebase that nobody is maintaining anymore.

Reviewed through automated stages and approved by a human before publication.