Security advisory 2026-08-13

✖
Copy to clipboard

Insufficient validation of macro input

CVSS: 8.6
Affected versions: 30.8.0 - 31.7.2
Category: SQL injection

Summary

Due to insufficient validation of user-supplied input in a macro that was usable across multiple features, including email templates, an authenticated administration user with sufficient permissions could use the macro to execute unauthorized SQL commands within the application’s database context.

The issue was resolved by validating field names against the data model before they are used in database queries.

How to fix

Update to the latest version. See Update Xperience by Kentico projects for detailed instructions.

Acknowledgments

This issue was reported by Ethan Pike.