CVE-2026-105158

Name of the Vulnerable Software and Affected Versions RainyGao DocSys versions prior to 2.02.86

Description An issue exists in the Database Management component where the createDBForMysql() function in the BaseController.java file is susceptible to SQL injection. This occurs when the url argument is manipulated, allowing a remote attacker to execute unauthorized SQL commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the createDBForMysql() function to minimize the risk of exploitation.