CVE-2026-2122 is a medium severity SQL injection (CVSS 6.3) in Xiaopi Panel up to version 20260126, in the demo.php file of its WAF Firewall component. The vendor did not respond to the reporter, and no fix is listed, so restrict access to the panel.
What's affected
The record names Xiaopi Panel up to 20260126, in the file /demo.php of the WAF Firewall component. The weakness is classed as CWE-89 (SQL injection) and CWE-74 (injection). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which needs a low privileged account.
The record says the vendor was contacted early about the disclosure and did not respond. No fixed version is listed. The record says an exploit was released publicly. It does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find out whether Xiaopi Panel is installed and which build you run.
find / -type f -name "demo.php" -path "*waf*" 2>/dev/null
Compare the build date or version with 20260126. If your build is that date or older, treat it as affected. Look in the panel access logs for requests to the demo script from unfamiliar addresses.
What to do now
- Limit who can reach the panel to a VPN or an address allowlist.
- Remove or block the demo.php script in the WAF component if you do not use it.
- Use the lowest privilege accounts you can in the panel, since the record says a login is needed.
- Rotate the passwords and API keys the panel stores if logs show suspicious use.
- Contact the vendor for a patched build and watch the NVD entry for updates.
Why it matters
It is an irony of this record that the bug sits in a firewall component. A security feature that takes input from the network is itself an attack surface, and it needs the same input handling as any other code. The record has the injection in a demo script, a file that often ships in a product without ever being meant for production.
With no vendor response, the practical defence is to shrink the exposure. Reduce who can log in, remove what you do not use, and watch for a fixed build.
Quick check
Does this need a login?
The vector says low privileges are required (PR:L), so an attacker needs a valid account first. That lowers the score compared with similar records that need none.
Sources
- Researcher report on GitHub (linked from the record)
- NVD record for CVE-2026-2122
Last reviewed: 19 October 2026.
