CVE-2026-112017

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.5

Description Authenticated attackers can bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. This allows for boolean or time-based blind injection—a technique used to extract data from a database by asking true/false questions or measuring response times—via endpoints such as '/sys/dict/getDictItems'. This flaw can be used to extract sensitive database contents, including administrator password hashes from the sys user table.

Recommendations Update to version 3.9.5 or later.