Skip to content
Verified Unauthenticated SQL injection in dotCMS Publish Audit API
REPRO-2026-00194 dotCMS/core · github SQLi Jul 1, 2026 .txt
Severity CRITICAL
Confidence HIGH
Reproduced in 116m 7s
Tool calls 532
Spend $10.15
Affected dotCMS Core 25.11.04-1 through 26.04.28-02
$ pruva-verify REPRO-2026-00194
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00194/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

CVE-2026-8054 / GHSA-jpx3-25r2-jq5g affects dotCMS Core Publish Audit API endpoints. Public advisory data reports unauthenticated SQL injection in /api/auditPublishing/get and /api/auditPublishing/getAll for dotCMS Core versions 25.11.04-1 through 26.04.28-02, fixed in 26.04.28-03. The vulnerable path was not backported to LTS releases.

03 · Root cause
Variant analysis
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.