CVE-2026-111390
CVE-2026-111390 · Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
CVSS 6.0 · Medium · EPSS 0.4%
- Published
- Updated
Affected products and versions
erupt
- Versions
- ≥ 0, ≤ 2.3.0: Affected (custom)
No fix published
Original sources
- https://hackmd.io/m0EK1XcGQfua6QHIXXNqMQ
- https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/service/EruptService.java#L62-L71
- https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/util/TypeUtil.java#L107-L115
- https://github.com/erupts/erupt/blob/2.3.0/erupt-data/erupt-data-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java#L210-L212
- https://github.com/erupts/erupt
- https://www.vulncheck.com/advisories/erupt-through-2.3.0-hql-injection-via-linktreeval-in-data-table-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111390