CVE-2026-25993

The application stores the url_key value in the database. During processing of category update or deletion events, the path and request_path fields — derived from url_key — are inserted directly into SQL queries using string concatenation and passed to the execute() function. If an attacker manages to save a malicious string in url_key, it will be used in the subsequent stage during SQL query execution, which is a classic second-order SQL injection — the payload is not executed immediately upon input, but during the next data processing.

An attacker can gain unauthorized access to data stored in the database (high confidentiality) and modify it (high integrity), which in an e-commerce environment means a risk of customer data, orders, and store configuration leakage.

Update EverShop to version v2.1.1 or later, in which the vulnerability has been patched. The fix is available in commit 5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd in the vendor's repository.

EverShop in versions prior to v2.1.1