{"schema":"threatline.record/2","record":{"id":"CVE-2026-111390","aliases":[],"summary":"Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API","details":"Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.","categories":["Unclassified"],"product":"erupt","vendor":"erupts","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111390","source_modified_at":"2026-10-21T02:18:10.357Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"erupt","vendor":"erupts","versions":[{"version":"0","lessThanOrEqual":"2.3.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00281,"percentile":0.19536,"score_date":"2026-10-23"},"published_at":"2026-10-16T11:38:02.147Z","modified_at":"2026-10-21T02:18:10.357Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111390","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T02:18:10.357Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111390","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/m0EK1XcGQfua6QHIXXNqMQ","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/service/EruptService.java#L62-L71","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/util/TypeUtil.java#L107-L115","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/erupts/erupt/blob/2.3.0/erupt-data/erupt-data-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java#L210-L212","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/erupts/erupt","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/erupt-through-2.3.0-hql-injection-via-linktreeval-in-data-table-api","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-21T02:17:25.317481Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-21T02:18:10.357Z","content_hash":"6275cab510d0268de1e8c513b10b1cb7a69bb638ffb79b31e8c85ca6dcbad992"}}