Apache Cocoon: SQL injection via SQL processor and sql/esql logicsheets

Summary

Apache Cocoon, a retired web and XML publishing framework, contains an SQL injection flaw in its SQL processor and in the sql: and esql: logicsheets. Missing input sanitation allows an attacker to inject arbitrary SQL commands, which can lead to unauthorized reading or modification of connected databases. The vendor will not release a fix because the project is retired, so affected instances remain vulnerable.

Affected

• Apache Cocoon: all versions
• Vulnerable component: SQL processor and sql:/esql: logicsheets
• CVSS 3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), as provided in the CVE data; verify on NVD

Fixed in

• No fix available. The project is retired and no fixed version will be released.

Workaround

• Find an alternative framework, as recommended by the vendor.
• Restrict access to the instance to trusted users only.
• Do not switch from sql: to esql: logicsheets as a fix; the advisory names both.
• Limit database account rights and restrict network paths from Cocoon to the database.

Exploitation

• No evidence of exploitation in the wild found at time of writing.
• Not listed in CISA KEV according to third-party sources; check the CISA KEV catalogue directly.
• No public proof of concept known; not verified in depth.
• Authentication requirements are not stated in the sources; the CVSS vector indicates low privileges (PR:L).

Our recommendation

• Inventory all Cocoon instances, including old or forgotten ones, and check whether they use the SQL processor or sql:/esql: logicsheets.
• Plan migration to a maintained framework and rewrite database access with parameterised queries.
• Until migration, isolate instances behind VPN or an authenticated reverse proxy and restrict access to trusted users.
• Log and alert on unusual database errors and query patterns from the Cocoon host.
• Prioritise internet-facing Cocoon applications with database-backed pages.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• oss-security: CVE-2026-108087 Apache Cocoon SQL Injection www.openwall.com
• Apache lists thread for CVE-2026-108087 lists.apache.org
• Apache Attic: Cocoon project status attic.apache.org
• Strix CVE record CVE-2026-108087 www.strix.ai
• NVD aggregator record CVE-2026-108087 (vulners) vulners.com
• OpenCVE CVE-2026-108087 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:36.