Xibo Digital Signage Platform Hit with Critical SQL Injection

The National Vulnerability Database has identified CVE-2026-31952, a high-severity SQL injection vulnerability impacting Xibo’s open-source digital signage platform. Versions 1.7 through 4.4.0 of the Xibo CMS are susceptible, allowing authenticated users with specific privileges to access and manipulate database records. This exploit targets API routes used for filtering DataSets, enabling attackers to exfiltrate or alter critical information.

Attackers can leverage this flaw if they possess either the Access to DataSet Feature or Access to the Layout Feature privilege. The CVSS score of 7.6 highlights the significant risk, with the vector indicating network accessibility and low complexity. Defenders must prioritize patching these systems to prevent unauthorized data access and modification, which could lead to operational disruption or data integrity issues.

Xibo has released version 4.4.1 to address this vulnerability. Customers utilizing Xibo Signage’s hosted CMS have been patched if on supported versions. For self-hosted instances, upgrading to the latest version is imperative. Patches are also available for older, out-of-support versions (3.3, 2.3, and 1.8), emphasizing the need for ongoing maintenance even for legacy deployments.