CVE-2026-111866: SQL Injection in nemoTyrant's manong via arr2sql()

Overview

A SQL injection vulnerability tracked as CVE-2026-111866 affects nemoTyrant's manong, an open-source PHP project, up to and including commit 7c9e5228e133b9267ad3a415833bc9bb53193bb4. The flaw carries a CVSS 3.1 score of 7.3 (High) and was first disclosed on October 17, 2026. NVD classifies the issue under CWE-89 (SQL Injection) and CWE-74 (Injection).

The vulnerable code lives in the arr2sql function inside func.php, under the project's cache/del_cache path — a utility responsible for converting array data into SQL query strings, a pattern commonly found in lightweight CMS and caching layers that build queries dynamically rather than through parameterized bindings. manong follows a rolling release model, so NVD's record does not list discrete affected or fixed version numbers; exposure is tracked by commit hash instead.

A related GitHub issue on the project was closed as "completed," but researchers have not been able to identify the specific pull request or commit that resolved it, which means it remains unclear whether a genuine fix has shipped or the issue was closed administratively. No public proof-of-concept exploit is currently available.

Technical Details

How It Works

The arr2sql function is a helper that turns array-structured data — typically cache keys, filter conditions, or query parameters — into raw SQL fragments. NVD's description indicates that input reaching this function is not neutralized before being incorporated into a SQL statement, consistent with CWE-89's classic pattern: externally-influenced data flows into a query string without parameterized binding or escaping.

Because the function sits in a cache invalidation path (del_cache), it is plausible that an attacker-controlled identifier — such as a cache key tied to user-submitted content — reaches arr2sql and is used to build a DELETE/WHERE-style SQL fragment. The CVSS vector's AV:N (network) and PR:N/UI:N (no privileges or user interaction needed) indicate the vulnerable path is reachable remotely without authentication, though NVD's record does not specify the exact HTTP-facing entry point that leads into this function.

Impact Assessment

Recommendations

For manong operators

1. Audit your deployment's commit hash against 7c9e5228e133b9267ad3a415833bc9bb53193bb4 and later history for changes to cache/del_cache/func.php or arr2sql.
2. Do not assume the linked GitHub issue's "completed" status reflects a verified fix. Review the diff yourself or pin to a commit you have independently validated.
3. Apply input validation or parameterized queries around any code path that feeds into arr2sql if you maintain a fork or cannot confirm upstream remediation.
4. Monitor database logs for malformed or unexpected SQL fragments originating from cache-invalidation requests.

For security teams

1. Treat rolling-release projects without version numbers as higher operational risk — track exposure by commit hash and re-verify after every pull rather than relying on a version-based patch cadence.
2. Flag this project for re-assessment once a confirmed fixing commit or maintainer advisory becomes available.

Key Takeaways

1. CVE-2026-111866 is a CVSS 7.3 High SQL injection in the arr2sql function of nemoTyrant's manong, reachable remotely with no authentication.
2. The flaw sits in a cache-invalidation path (cache/del_cache/func.php), a pattern that often handles attacker-influenced identifiers.
3. manong's rolling release model means there are no discrete affected/fixed version numbers — exposure must be tracked by commit hash.
4. A related GitHub issue was closed as "completed," but no fixing commit or PR has been confirmed, leaving remediation status unclear.
5. No public exploit is currently available, but the unauthenticated, network-reachable nature of the flaw warrants prompt review by anyone running this project.

Sources

• NVD — CVE-2026-111866
• VulDB — VDB-421574
• GitHub — nemoTyrant/manong

CosmicBytez Labs will update this advisory if nemoTyrant or independent researchers confirm a fixing commit for CVE-2026-111866.