SQL injection in github.com/stashapp/stash

MEDIUM 6.3CVE-2024-32231 · GHSA-75jf-52jg-qqh4 · GO-2024-3070 · Published 15/08/2024 · updated 17/06/2026

In short

CVE-2024-32231 is a MEDIUM (CVSS 6.3) vulnerability affecting github.com/stashapp/stash, stash (stashapp).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.6% of all vulnerabilities.
Fix: update to 0.26.0 or later.

Package	Affected versions	Patched versions
github.com/stashapp/stash Go	`< 0.26.0`	`0.26.0`
stash stashapp	`≤ 0.25.1`	No fix yet

Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.

NVD description

Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.