CVE-2026-97293 is an SQL Injection vulnerability (CWE-89) in Media LIbrary Assistant versions up to 3.41. The issue arises from improper neutralization of special elements used in SQL commands within the Contributor feature. The CVSS 3.1 score is 8.5, indicating high severity, with attack vector network, low attack complexity, low privileges required, no user interaction, and scope changed. The impact affects confidentiality (high) and availability (low), but not integrity. No known exploits in the wild or vendor patch information are currently available.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The impact includes high confidentiality loss and low availability impact, potentially allowing unauthorized access to sensitive data and causing partial denial of service conditions. Integrity is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the Contributor functionality to untrusted users.