What’s Vulnerable › Vulnerabilities

CVE-2026-25993: EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-10 · updated 2026-06-17
• Weakness: CWE-89

Description

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.

Affected products

• evershopcommerce evershop: through 2.1.0

References

• http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd
• https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch

Get alerted when CVE-2026-25993 or the next vulnerability affects your stack