{"action":"No fix published. Pin and monitor.","affected":[],"component":"ezsystems/ezpublish-legacy","cve_ids":["CVE-2026-38739"],"ecosystem":"Packagist","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xg9x-h37w-h3r3","id":"tcs_01M5KFB0HTXZ5N1EBATNR37CV0","modified_at":"2026-09-10T03:50:47.968897146Z","published_at":"2026-05-29T19:07:38Z","references":["https://osv.dev/vulnerability/GHSA-xg9x-h37w-h3r3","https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-xg9x-h37w-h3r3","https://github.com/ezsystems/ezpublish-legacy"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-xg9x-h37w-h3r3","url":"https://osv.dev/vulnerability/GHSA-xg9x-h37w-h3r3"}],"summary":"ezsystems/ezpublish-legacy has a SQL injection in dfscleanup"}