CVE-2026-111390: Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments are exposed where authenticated users have query permission on an entity whose linkTree target uses a String key. The affected request path is POST /erupt-api/data/table/{erupt}.
What access does an attacker need?
An attacker must be authenticated and hold query permission for a relevant entity. Exploitation requires supplying unescaped quotes in the linkTreeVal parameter to alter the HQL query.
What could an attacker access?
An attacker can bypass tree-scoped data filters and read data outside the intended tree scope. The described techniques include always-true OR clauses and boolean subqueries that can read data from other mapped entities.