CVE-2026-112017
JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
jeecgboot JeecgBoot
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.9.5JeecgBootCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.
Text from CVE List
Affected versions 1
- JeecgBootaffected: all versions before 3.9.5CVE List
References 6
- github.com/jeecgboot/JeecgBoot/commit/a2be896f753936956ee6863b632b8e5a0231345cFixvia CVE List
- github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.5Fixvia CVE List
- vulncheck.com/advisories/jeecgboot-before-3.9.5-sql-injection-via-sqlinjectionutil-newline-bypassAdvisoryvia CVE List
- github.com/jeecgboot/JeecgBoot/issues/9677Referencevia CVE List
- github.com/jeecgboot/JeecgBoot/blob/v3.9.2/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java#L269-L305Referencevia CVE List
- github.com/jeecgboot/JeecgBootReferencevia CVE List