SQL injection in Apache Fineract - CVE-2026-56287
Published: August 25, 2026
Vulnerability identifier: #VU145203
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56287
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose arbitrary files readable by the database process.
The vulnerability exists due to SQL injection in the Client Search API when processing crafted orderBy and sortOrder request parameters. A remote user can send a specially crafted request to disclose arbitrary files readable by the database process.
Exploitation requires permission to view clients and can also be used for blind boolean-based data extraction. File disclosure via LOAD_FILE() is supported on MySQL and MariaDB.
Affected software
Apache Fineract
How to mitigate CVE-2026-56287
Install security update from vendor's website.
Apache Fineract - update to 1.15.0