Security
EDocman SQL injection fixed in version 3.9.0
mySites.guru has disclosed an unauthenticated SQL injection in the Joomla extension EDocman, allowing database contents to be read remotely. JoomDonation fixed the issue in 3.9.0.
The vulnerability affects EDocman 3.8 and earlier releases, with the vulnerable feature reportedly present in the extension for a long time. It is tracked as CVE-2026-57832.
mySites.guru confirmed the flaw on a test installation using an anonymous request. The research showed that attackers could retrieve Joomla user records, password hashes, configuration data and other database contents. Where the site's database account has broad privileges, the potential exposure may extend beyond the Joomla site's own tables.
The report describes the issue as a critical-impact, unauthenticated SQL injection. It documents successful testing but does not report exploitation in the wild. The researchers are withholding the endpoint and proof of concept while administrators apply the fix.
- Update every affected installation to
EDocman 3.9.0. - If an immediate update is impossible, use a SQL-injection-filtering web application firewall as a temporary mitigation.
- Review logs and investigate possible exposure, particularly on sites using highly privileged database accounts.
Originally reported by mySites.guru.