GitHub Advisoryadvisory · Packagist

GHSA-xp6r-8pcc-xv5p BillaBear is Vulnerable to SQL Injection in the EventRepository

HIGH Published 2026-05-19 Modified 2026-06-04 Official page ↗
Aliases
CVE-2026-31069
Ecosystem
Packagist
Packages
billabear/billabear
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2026-06-04

Affected packages

• Packagist billabear/billabear: <= 2025.01.03 (no fix yet)

Description

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.

Related

Alias · CVE (1)

  • CVE-2026-31069 BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References