CVE-2026-36458 describes a SQL injection vulnerability in ChestnutCMS v1.5.10. Specifically, the content parameter of the cms_content tag in the admin backend is not properly sanitized before being used in a SQL query during template rendering. This flaw allows injection of malicious SQL code, which could compromise the database integrity or confidentiality. There is no CVSS score or vendor advisory available, and no patch or mitigation details have been published.

An attacker with access to the admin backend can exploit this vulnerability to inject arbitrary SQL commands. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the privileges of the database user. Since the vulnerability is in the admin backend, exploitation requires some level of administrative access, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the admin backend to trusted users only and monitor for suspicious activity. Avoid using untrusted input in the content parameter of the cms_content tag. Follow up with the vendor for updates on patches or official mitigations.