CVE-2026-59075

UNKNOWN 0.0

Dynamic LINQ Injection in Edito CMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

CWE	CWE-917
Vendor	edito
Product	edito cms
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for edito edito cms

Be the first to know when new unknown vulnerabilities affecting edito edito cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Edito / Edito CMS

0 < 5.10.2607

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/11/CVE-2026-59074 edito.pl: https://www.edito.pl/

Credits

Michał Majchrowicz (AFINE Team) Dawid Małecki (AFINE Team) Paweł Zdunek (AFINE Team)