CVE-2026-7290: JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7290?
CVE-2026-7290 is a high severity vulnerability due to the possibility of SQL injection, which can lead to unauthorized access to the database.
How do I fix CVE-2026-7290?
To fix CVE-2026-7290, upgrade JeecgBoot to version 3.9.2 or later where the vulnerability is patched.
What impact does CVE-2026-7290 have on my system?
CVE-2026-7290 can allow an attacker to manipulate SQL queries, potentially compromising sensitive data within the database.
Which software versions are affected by CVE-2026-7290?
CVE-2026-7290 affects JeecgBoot versions up to and including 3.9.1.
Where can I find more details about CVE-2026-7290?
More details about CVE-2026-7290 can typically be found in the JeecgBoot GitHub repository or related issue discussions.