CVE-2026-111390
CVE-2026-111390 · Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
CVSS 6.0 · Media · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
erupt
- Versiones
- ≥ 0, ≤ 2.3.0: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/m0EK1XcGQfua6QHIXXNqMQ
- https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/service/EruptService.java#L62-L71
- https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/util/TypeUtil.java#L107-L115
- https://github.com/erupts/erupt/blob/2.3.0/erupt-data/erupt-data-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java#L210-L212
- https://github.com/erupts/erupt
- https://www.vulncheck.com/advisories/erupt-through-2.3.0-hql-injection-via-linktreeval-in-data-table-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111390