SZB-975c120304
CVE-2026-61804 reported in myTinyWMS product and category name handling
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- myTinyWMS
- Product
- myTinyWMS
- First seen
Summary
CVE-2026-61804 is reported in myTinyWMS, a free open-source warehouse management system, with a CVSS score of 8.1. The listing says versions before 1.6.4 store the name parameter in Product (Artikel) and Category management without adequate backend sanitization, and the item does not state whether it is being exploited.
If you use myTinyWMS
Check whether myTinyWMS is deployed and which version is running
Upgrade myTinyWMS to version 1.6.4 or later
Restrict editing of products and categories to trusted users until patched
What the sources say 1
· Mastodon: “Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped ...” Source