CVE-2026-31952 is an SQL injection vulnerability (CWE-89) in the Xibo CMS platform affecting versions from 1.7 up to but not including 4.4.1. The vulnerability exists in API routes that handle filtering of DataSets, allowing authenticated users with either 'Access to DataSet Feature' or 'Access to the Layout Feature' privileges to inject specially crafted values into the API filter parameter. This injection can be used to obtain and modify arbitrary data within the Xibo database. The issue is resolved in version 4.4.1, and patches are also available for older unsupported versions (3.3, 2.3, 1.8). Customers using the hosted CMS service have been patched for supported versions.

An authenticated user with certain privileges can exploit this vulnerability to perform SQL injection attacks, leading to unauthorized disclosure and modification of data in the Xibo CMS database. The CVSS score of 7.6 (high severity) reflects the network attack vector with low attack complexity but requiring privileges. The impact includes high confidentiality loss, limited integrity loss, and limited availability loss.

Upgrade affected Xibo CMS instances to version 4.4.1 or later, which contains the official fix for this vulnerability. For users on older unsupported versions (3.3, 2.3, 1.8), apply the available patches provided by the vendor. Customers using the Xibo Signage hosted CMS service have already been patched by the vendor. No other mitigation steps are indicated beyond upgrading or patching.