CVE-2026-38739: ezsystems/ezpublish-legacy SQL Injection Vulnerability in dfscleanup
Summary
CVE-2026-38739: ezsystems/ezpublish-legacy has a SQL injection in dfscleanup. Affects ezsystems/ezpublish-legacy versions 2019.03. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eZ Publish Legacy is a content management system (CMS) designed for building and managing websites. It offers features such as content versioning, user management, and customizable templates. However, this software is now past its end of life, meaning it no longer receives updates or support, making it vulnerable to security issues like SQL injection.
Vulnerability Detail
The vulnerability exists in the dfscleanup.php script, specifically within the _getFileList function of the eZDFSFileHandlerMySQLiBackend class. An attacker with local shell access and sufficient privileges can exploit this vulnerability to perform a union-based SQL injection against the eZ Publish MySQL database. This could lead to the exposure of sensitive data, including user credentials. The issue is known to affect the 2019.03 branch and potentially other branches as well.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no workarounds available for this vulnerability due to the software's end-of-life status.
Conclusion
The CVE-2026-38739 vulnerability in ezsystems/ezpublish-legacy poses a significant risk due to its potential for SQL injection attacks. Users are strongly encouraged to migrate to supported software to mitigate these risks.
See every vulnerability recorded for ezsystems/ezpublish-legacy →
FAQ
CVE-2026-38739 is a SQL injection vulnerability found in the ezsystems/ezpublish-legacy package, specifically in the dfscleanup.php script.
If exploited, this vulnerability can allow attackers to access sensitive data in your MySQL database, including user credentials.
No, there are no patches available as the software is past its end of life.
It is recommended to migrate to a supported version of eZ Publish or consider alternative content management systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/ezpublish-legacy.
