CVE-2026-36418: JimuReport RCE Vulnerability

CVE-2026-36418 Overview

CVE-2026-36418 is a remote code execution vulnerability affecting JimuReport versions 2.3.4 and below. The flaw resides in the /jmreport/executeSelectApi endpoint, which forwards user-supplied input directly to the Aviator expression engine without adequate validation. Unauthenticated attackers can submit crafted Aviator expressions that the engine evaluates, leading to arbitrary code execution on the server. The issue is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Remote, unauthenticated attackers can execute arbitrary code on affected JimuReport servers, compromising confidentiality and integrity of report data and underlying systems.

Affected Products

JimuReport versions 2.3.4 and below
Deployments exposing the /jmreport/executeSelectApi endpoint
Applications embedding the vulnerable Aviator expression evaluation flow

Discovery Timeline

2026-06-17 - CVE-2026-36418 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-36418

Vulnerability Analysis

JimuReport is a low-code reporting platform that uses the Aviator lightweight expression engine to evaluate dynamic logic embedded in report definitions and API queries. The /jmreport/executeSelectApi endpoint accepts request parameters that are concatenated into an Aviator expression and passed to the engine for evaluation. Because Aviator supports reflective method calls and access to Java runtime objects, expression input that is not strictly validated becomes a direct path to native code execution.

The endpoint is reachable over the network and, in default deployments, does not enforce authentication on the vulnerable code path. An attacker only needs HTTP access to the application to deliver a payload. The published proof of concept demonstrates execution of operating system commands through an Aviator expression that resolves to java.lang.Runtime.exec or equivalent reflective invocations.

Root Cause

The root cause is the absence of a sanitization or allow-list layer between HTTP input and the Aviator expression evaluator. The application treats expression strings as trusted data. Aviator, by design, exposes broad runtime functionality unless its sandbox features are explicitly configured. JimuReport invokes the engine in its permissive default mode.

Attack Vector

The vulnerability is exploited remotely over HTTP. An attacker sends a POST request to /jmreport/executeSelectApi containing an Aviator expression payload in a controlled parameter. The server evaluates the expression and returns or executes the result. Refer to the GitHub PoC Repository for a documented exploitation walkthrough.

No verified sanitized code example is published. The attack mechanism is described above in prose.

Detection Methods for CVE-2026-36418

Indicators of Compromise

HTTP POST requests to /jmreport/executeSelectApi containing Aviator syntax such as seq.list, tuple, or reflective references to java.lang.Runtime or ProcessBuilder.
Unexpected child processes spawned by the Java application process running JimuReport, including shells, curl, wget, or powershell.
Outbound network connections initiated by the JimuReport JVM to unfamiliar hosts shortly after requests to the affected endpoint.

Detection Strategies

Inspect web access logs for requests to /jmreport/executeSelectApi and correlate request bodies against Aviator function names and Java class references.
Apply behavioral identification rules that flag the JimuReport JVM process spawning command interpreters or scripting hosts.
Use EDR or XDR telemetry to correlate the parent Java process with anomalous child process creation and file writes to web-accessible paths.

Monitoring Recommendations

Forward application and reverse proxy logs to a centralized SIEM and alert on bursts of requests targeting JimuReport API paths.
Monitor for new files written to JimuReport working directories, particularly executables, JSPs, or shell scripts.
Track JVM resource consumption and outbound DNS queries for indicators of post-exploitation tooling.

How to Mitigate CVE-2026-36418

Immediate Actions Required

Upgrade JimuReport to a fixed release above version 2.3.4 as soon as the vendor publishes a patched build.
Restrict network access to JimuReport administrative and API endpoints, exposing them only to trusted internal networks or via authenticated reverse proxies.
Audit servers for indicators of post-exploitation activity, including new accounts, scheduled tasks, and unexpected outbound connections.

Patch Information

No vendor advisory URL is included in the published CVE data. Administrators should monitor the JimuReport project release channels for a version above 2.3.4 that addresses the Aviator expression handling. Refer to the GitHub PoC Repository for current technical context on the issue.

Workarounds

Block external access to the /jmreport/executeSelectApi path at the web application firewall or reverse proxy until a patched version is deployed.
Add WAF rules that reject request bodies containing Aviator function references, java.lang., Runtime, ProcessBuilder, or similar reflective tokens.
Run the JimuReport JVM as an unprivileged service account with restricted file system and outbound network permissions to limit blast radius.

bash

# Example: block the vulnerable endpoint at an Nginx reverse proxy
location /jmreport/executeSelectApi {
    deny all;
    return 403;
}