CVE-2026-5801 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-5801 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-5801 is a critical SQL injection vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP affecting versions through 23042026. A successful exploit can lead to command line execution, which means an attacker may be able to run arbitrary commands on the host running the application. Even though there is currently no known exploitation in the wild and it is not in CISA KEV, the severity is high enough that solo developers and small teams should treat this as an urgent patch-and-verify event.

If you run SEM-PMP directly, behind a reverse proxy, or as part of a larger service chain, assume the blast radius includes the application server, connected databases, and any credentials stored on the same system.

Immediate Action

  • Upgrade SEM-PMP immediately to the first vendor-fixed release. If the fixed version is not yet published, disable or isolate the affected SEM-PMP component until a patch is available. See the vendor advisory.
  • Restrict access to the SEM-PMP interface at the network layer: allow only trusted VPN, office IPs, or internal subnets.
  • Rotate database and service credentials used by SEM-PMP, especially if the app has broad SQL permissions or shell access.
  • Back up and snapshot the host and database before making changes, then preserve logs for review.
  • Rollback guidance: if the upgrade breaks workflows, roll back only after confirming the vulnerable service is not internet-exposed and is isolated from sensitive data.
  • Monitor for abuse by reviewing web, application, and database logs for unexpected SQL syntax, command execution attempts, or unusual child processes.

Affected Versions

  • SEM-PMP <= 23042026 vulnerable
  • SEM-PMP > TODO_FIXED_VERSION safe
  • TODO: confirm the first patched release from the vendor advisory and replace TODO_FIXED_VERSION with the exact version number

Resolution Guide

1) Upgrade or remove the vulnerable release. If SEM-PMP is installed as a package, container, or system service, update to the fixed version as soon as it is available.

# npm / yarn / pnpm (if SEM-PMP is distributed as a JS package)
npm i sem-pmp@TODO_FIXED_VERSION
yarn add sem-pmp@TODO_FIXED_VERSION
pnpm add sem-pmp@TODO_FIXED_VERSION

# Python
pip install --upgrade sem-pmp==TODO_FIXED_VERSION
pipx upgrade sem-pmp

# Java
# Maven
mvn versions:use-latest-releases -Dincludes=com.semtek:sem-pmp
# Gradle
./gradlew dependencyUpdates

# Linux package managers
sudo apt-get update
sudo apt-get install --only-upgrade sem-pmp
sudo yum update sem-pmp

# Docker
docker pull semtek/sem-pmp:TODO_FIXED_VERSION
docker run --rm semtek/sem-pmp:TODO_FIXED_VERSION

2) Harden the deployment while patching. If you cannot upgrade immediately, reduce exposure:

# Example: disable external access at the host firewall
sudo ufw deny 443/tcp
sudo ufw allow from 10.0.0.0/8 to any port 443 proto tcp

# Example: run the service with least privilege
sudo systemctl edit sem-pmp
# Add:
# [Service]
# User=sem-pmp
# NoNewPrivileges=true
# PrivateTmp=true

3) If a vulnerable SQL path can be disabled, do it now. Use feature flags or config to turn off the affected module, API route, or report builder until the patch is deployed.

# Example config hardening
SEM_PMP_DISABLE_LEGACY_SQL=1
SEM_PMP_DISABLE_ADVANCED_SEARCH=1
SEM_PMP_ALLOWLIST_IPS=10.0.0.0/8,192.168.0.0/16

4) Minimal code fix pattern. If your integration builds SQL strings, replace string concatenation with parameterized queries:

// Vulnerable
const sql = "SELECT * FROM users WHERE name = '" + req.query.name + "'";

// Fixed
const sql = "SELECT * FROM users WHERE name = ?";
db.query(sql, [req.query.name]);

Detection & Verification

Check whether you are vulnerable:

# Find installed version
sem-pmp --version
dpkg -l | grep -i sem-pmp
rpm -qa | grep -i sem-pmp

# Search code/config for risky SQL construction
grep -RInE "SELECT .*\\+|execute\\(|exec\\(|sql .*\\+" /opt/sem-pmp /srv /var/www 2>/dev/null

# Dependency audits
npm audit
pip-audit
mvn dependency:tree | grep -i sem-pmp
./gradlew dependencies | grep -i sem-pmp

Verify the fix:

# Confirm the version is above the vulnerable range
sem-pmp --version

# Re-run dependency checks after upgrade
npm audit --production
pip-audit
mvn -q dependency:tree | grep -i sem-pmp

# Confirm the service restarted cleanly
sudo systemctl status sem-pmp
journalctl -u sem-pmp --since "1 hour ago"

Also confirm that the application no longer accepts raw SQL input in the affected path, and that any WAF or reverse proxy rules are blocking obvious injection patterns only as a temporary control, not a substitute for patching.

Risk and Impact

This flaw can let an attacker inject SQL that escalates into command line execution, turning a web request into host-level compromise. For a small team, that can mean stolen database contents, leaked API keys, tampered records, or a foothold for ransomware. If SEM-PMP has access to production databases or shared infrastructure, the impact can spread well beyond the app itself.

Bottom line: treat CVE-2026-5801 as a same-day remediation item. Patch first, isolate second, and verify with version checks and log review immediately after deployment.

Keep reading