CVE-2026-25773：Focalboard SQL注入漏洞（高危）

CVE-2026-25773 影响 Focalboard 8.0 版本，暴露了二阶 SQL 注入（Time-Based Blind）漏洞。此漏洞源于应用程序在类别重新排序过程中，未正确清理类别 ID，导致将其嵌入到动态 SQL 语句中。经过身份验证的攻击者可以在类别 ID 字段中注入恶意 SQL 负载，该负载存储在数据库中，并在类别重新排序 API 处理存储值时未经适当验证地执行。这允许通过基于时间的盲 SQL 注入技术，泄露包括密码哈希在内的敏感数据。该问题的严重程度评分为 CVSS 8.1，表明存在重大风险。

Organizations using Focalboard for project management, particularly those relying on it for sensitive data storage, are at risk. The lack of support means that these organizations are exposed to a known vulnerability with no official remediation path. Shared hosting environments where multiple users have access to the Focalboard instance are particularly vulnerable, as an attacker could potentially compromise other users' accounts.

• linux / server: Monitor database logs (e.g., MySQL slow query log) for unusual SQL queries involving category IDs. Use journalctl to filter for errors related to SQL execution.

journalctl -u mysqld -g 'category id' --since '1h'

• generic web: Use curl to test the category reordering API with various inputs, looking for unusual response times or errors.

curl -X POST -d 'category_id=1; SELECT sleep(5);' <reordering_api_endpoint>

• database (mysql): Check for suspicious stored procedures or functions that might be used to exploit the vulnerability.

SHOW PROCEDURE STATUS WHERE db = 'focalboard' AND Name LIKE '%category%';

1. 2026-04-03Disclosure

   disclosure

1. 已保留2026-04-03
2. 发布日期2026-04-03
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-11

目前，CVE-2026-25773 没有可用的修复程序（fix）。最有效的即时缓解措施是，一旦可用，升级到修复了此漏洞的 Focalboard 版本。在此期间，将类别重新排序 API 的访问限制为具有最小权限的用户。实施全面的数据库监控，以检测可能表明利用尝试的异常流量模式。此外，审查并加强密码策略，以最大限度地减少密码哈希被破坏时可能造成的潜在影响。强烈建议关注 Focalboard 关于安全更新可用性的公告。