CVE-2026-125381: DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
DataRoom versions through 3.0.0 are affected. Exposure applies where users with the sharer role can submit dataset parameters to the affected dataset execution endpoint.
What access does an attacker need?
An attacker needs sharer-role privileges; no user interaction is required. They can send crafted inputParam values to /dataRoom/dataset/run.
What input conditions enable exploitation?
The issue is triggered when dataset parameters are incorporated as unquoted string parameters or when MySQL backslash escapes can be abused. Crafted parameter values can then inject SQL for execution against the database.