External risk intelligence

SQL Injection in getVideoSubcanal Endpoint Exposes File Paths and Stack Traces

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81672

The vulnerability exists in an API endpoint ('/ws/apiprensa/getVideoSubcanal') designed for remote data retrieval. Web APIs are commonly deployed as internet-facing services to facilitate communication between client applications and server-side infrastructure, making them a common part of the public-facing web attack surface.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability has been identified in an application's API, specifically within the 'getVideoSubcanal' endpoint. This flaw could allow unauthorized access to internal system details, increasing the potential risk to the application. The primary concern is to confirm if our environment is affected and understand the scope of exposure.

Flaw allows unauthorized access to system details.
Matters because it reveals internal information.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to the `/ws/apiprensa/getVideoSubcanal` endpoint. This endpoint is exposed externally and does not properly validate the `id_video` parameter, allowing an attacker to inject malicious SQL commands. Successful injection can lead to the disclosure of internal file paths and detailed error messages, including stack traces, which can aid further attacks.

No authentication or user interaction needed.
Triggered via a vulnerable API endpoint parameter.
Exposes internal system details.

Live Threat

Current exploitation, exposure, and threat context

The SQL injection vulnerability in the `/ws/apiprensa/getVideoSubcanal` endpoint could allow an attacker to execute arbitrary SQL queries. This could expose internal file paths and detailed stack traces when specific error conditions are met, potentially revealing sensitive system configurations.

Internal file paths and stack traces may be exposed.
Improper input handling allows malicious SQL queries.
Information disclosure may aid further attacks.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner or platform team is likely responsible for this SQL injection vulnerability. The first practical step is to locate all instances of the affected application, determine if the exposed API endpoint is reachable from the internet or an untrusted network, and then assess its business criticality to prioritize remediation efforts.

Identify application instances.
Verify endpoint exposure and criticality.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software component affected by CVE-2026-81672?

The vulnerability affects an API endpoint named '/ws/apiprensa/getVideoSubcanal'. This component functions as a web service designed for remote data retrieval, allowing client applications to request information from server-side infrastructure. It specifically processes video-related data using an 'id_video' parameter to interface with the application's underlying database.

How does this SQL injection work in CVE-2026-81672?

This is a classic example of CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. The application takes input from the 'id_video' parameter and inserts it directly into database queries without sanitization. When the input contains malicious SQL characters, it alters the query logic, causing the Slim framework to return errors that reveal internal file paths and system stack traces.

When does a request trigger this SQL injection?

The vulnerability is triggered whenever a request is sent to the '/ws/apiprensa/getVideoSubcanal' endpoint containing a specially crafted 'id_video' parameter value. It does not require any prior authentication or user interaction to succeed. Conversely, simple or standard numerical inputs that the application expects will not trigger the bug, as the flaw specifically relies on the injection of malicious SQL command syntax.

Why is CVE-2026-81672 considered an external risk?

Halo Surface Signal identifies this as a significant concern because the affected API endpoint is designed for remote retrieval, making it a natural fit for internet-facing deployments. Because the endpoint is typically exposed to facilitate communication between external clients and the server, it resides on the public-facing web attack surface, meaning it can be reached by unauthorized parties over the internet.

What should I do if I run this application?

Your first priority is to locate all instances of the application within your infrastructure. Once identified, verify if the '/ws/apiprensa/getVideoSubcanal' endpoint is reachable from the internet or any untrusted network segments. After mapping your exposure, evaluate the business criticality of those specific instances to properly prioritize the necessary updates or security configuration changes.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.