CVE-2026-54831 is an unauthenticated SQL Injection vulnerability affecting Paolo GeoDirectory versions <= 2.8.162. The vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89). It allows remote attackers to execute SQL queries without any authentication, potentially leading to full disclosure of sensitive data (confidentiality impact is high), while integrity is not affected and availability impact is low. The CVSS v3.1 base score is 9.3, indicating critical severity. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands on the affected GeoDirectory database, leading to a high confidentiality impact due to potential data disclosure. Integrity is not impacted, and availability impact is low. This could result in unauthorized access to sensitive information stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or temporary mitigations recommended by the vendor. Monitor official Paolo GeoDirectory channels for updates and patches addressing this vulnerability.