Packagist/ezsystems/ezpublish-legacy CVE-2026-38739: high 7.1

ezsystems/ezpublish-legacy has a SQL injection in dfscleanup

Action: No fix published. Pin and monitor.

Affected

No affected ranges in the source.

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-xg9x-h37w-h3r3
• https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-xg9x-h37w-h3r3
• https://github.com/ezsystems/ezpublish-legacy

CVE-2026-38739 · published 2026-05-29T19:07:38Z · modified 2026-09-10T03:50:47.968897146Z · JSON