CVE-2026-108810 in tsi-dpdp-cms
Summary
by MITRE • 10/12/2026
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
A critical security vulnerability has been identified within tsi-coop tsi-dpdp-cms versions 0.5.0 through 0.5.2, specifically affecting the JSON Schema Validation component. This flaw stems from improper handling of input arguments passed to an internal function designated as _func. The core technical issue involves a failure in strict type checking or boundary validation during the schema parsing process. When an attacker provides a manipulated argument via this parameter, it triggers an unintended code path that exposes sensitive system information. This behavior aligns with CWE-209, which describes the generation of error messages containing sensitive information for users who may not be authorized to see such data. The vulnerability allows remote attackers to extract internal details about the application's structure, configuration, or underlying infrastructure without requiring authentication in some contexts, significantly lowering the barrier for exploitation.
The operational impact of this flaw is substantial due to its potential role as an initial vector for more severe attacks. By disclosing information that should remain hidden from external entities, adversaries can map out the internal architecture of the tsi-dpdp-cms environment. This intelligence gathering phase enables attackers to identify other weaknesses, such as specific API endpoints, database structures, or third-party integrations. In the context of the MITRE ATT&CK framework, this vulnerability facilitates reconnaissance activities, specifically aligning with techniques related to Application Error Message Information Discovery and potentially leading into subsequent exploitation phases like SQL injection or remote code execution if further vulnerabilities exist in the exposed components. The fact that a public exploit has been released amplifies the risk, as it allows less sophisticated threat actors to leverage existing tools against vulnerable instances without needing to develop custom payloads from scratch.
The attack vector is classified as remote, meaning exploitation can occur over a network connection such as the internet or an internal LAN without physical access to the target system. This characteristic makes the vulnerability particularly dangerous for web-facing deployments of tsi-dpdp-cms. The ease of execution combined with the availability of public exploits creates a high-risk environment where automated scanning tools and opportunistic attackers are likely to probe affected systems aggressively. Organizations relying on these versions face immediate threats to data confidentiality and system integrity, as the disclosed information can be used to craft targeted attacks against other parts of their infrastructure or sensitive customer data processed by the CMS platform.
To mitigate this risk, it is imperative that all organizations running tsi-coop tsi-dpdp-cms upgrade immediately to version 0.5.3 or later. The vendor has acknowledged the issue and released a patched version that addresses the input validation logic within the JSON Schema Validation component. This update ensures that arguments passed to internal functions are strictly validated against expected schemas, preventing the manipulation of _func from triggering information disclosure errors. In addition to upgrading, administrators should implement network-level controls such as web application firewalls to filter malformed requests and monitor logs for signs of exploitation attempts involving schema validation parameters. Regular security assessments and penetration testing should be conducted post-upgrade to verify that the remediation is effective and no residual vulnerabilities remain in related components.