CVE-2026-62251

EUVD-2026-94522
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.55%
Common Weakness Enumeration
References
https://github.com/sipcapture/homer/commit/a7d027dc684b210b62285c49f555ac88d64f35f0
https://github.com/sipcapture/homer/pull/837
https://github.com/sipcapture/homer/releases/tag/11.0.283
https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4