CVE-2026-7290: JeecgBoot SQL Injection Vulnerability

CVE-2026-7290 Overview

A SQL Injection vulnerability has been identified in JeecgBoot versions up to 3.9.1. The vulnerability exists in the SqlInjectionUtil function located within the jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java file of the loadDict Endpoint component. By manipulating the keyword argument, an attacker can inject malicious SQL statements. This vulnerability can be exploited remotely over the network.

Critical Impact

Remote attackers with low privileges can exploit this SQL injection flaw to manipulate database queries through the loadDict endpoint, potentially compromising data confidentiality, integrity, and availability.

Affected Products

• JeecgBoot up to version 3.9.1
• JeecgBoot loadDict Endpoint component
• SqlInjectionUtil.java in jeecg-boot-base-core module

Discovery Timeline

• April 28, 2026 - CVE-2026-7290 published to NVD
• April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-7290

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically manifesting as SQL Injection. The flaw resides in the SqlInjectionUtil utility class, which is responsible for sanitizing SQL input but fails to properly validate or neutralize malicious content passed through the keyword parameter.

The loadDict endpoint processes dictionary data requests and relies on the SqlInjectionUtil function to filter potentially dangerous SQL syntax. However, the existing validation logic can be bypassed, allowing crafted input to reach the underlying database query execution layer. This enables authenticated attackers to inject arbitrary SQL commands that execute within the context of the application's database connection.

The exploit has been publicly disclosed, increasing the risk of active exploitation in vulnerable deployments. Organizations running JeecgBoot should prioritize applying the available patch.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the SqlInjectionUtil class. The function fails to adequately sanitize or parameterize user-controlled input from the keyword argument before incorporating it into SQL queries. This classic injection flaw allows specially crafted input to break out of the intended query structure and execute arbitrary SQL statements.

Attack Vector

The attack is network-based and requires low privileges to execute. An authenticated attacker can send malicious requests to the loadDict endpoint with a crafted keyword parameter containing SQL injection payloads. The injection bypasses the existing SqlInjectionUtil protection mechanisms, allowing the attacker to:

• Extract sensitive data from the database
• Modify or delete database records
• Potentially escalate privileges within the application
• Execute additional database commands depending on the database configuration

The vulnerability requires no user interaction and can be exploited remotely. The publicly disclosed nature of this exploit increases the likelihood of active targeting.

Detection Methods for CVE-2026-7290

Indicators of Compromise

• Unusual or malformed requests to the loadDict endpoint containing SQL syntax in the keyword parameter
• Database error messages or anomalies in application logs indicating failed SQL injection attempts
• Unexpected database queries or data access patterns in database audit logs
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Monitor HTTP traffic to the loadDict endpoint for suspicious patterns including SQL keywords such as UNION, SELECT, INSERT, DELETE, DROP, or comment sequences
• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting the keyword parameter
• Enable database query logging and alert on anomalous query structures or unexpected data access
• Deploy runtime application self-protection (RASP) to detect SQL injection attempts at the application layer

Monitoring Recommendations

• Configure alerting for repeated failed requests or error responses from the loadDict endpoint
• Establish baseline query patterns and alert on deviations that may indicate injection attempts
• Monitor for unauthorized data access or privilege escalation within the JeecgBoot application
• Review application and web server access logs for reconnaissance activity targeting JeecgBoot endpoints

How to Mitigate CVE-2026-7290

Immediate Actions Required

• Upgrade JeecgBoot to a patched version that includes commit a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b
• If immediate patching is not possible, implement WAF rules to filter SQL injection payloads targeting the loadDict endpoint
• Review application logs for evidence of exploitation attempts
• Restrict network access to the JeecgBoot application to trusted IP ranges where feasible

Patch Information

The JeecgBoot development team has released a patch to address this vulnerability. The fix is identified by commit hash a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. For detailed patch information, refer to the GitHub Commit Update and the GitHub Pull Request. Additional context is available in the GitHub Issue Discussion.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules specifically blocking SQL injection patterns in requests to the loadDict endpoint
• Implement input validation at the application gateway or reverse proxy level to sanitize the keyword parameter
• Restrict access to the loadDict endpoint to only authenticated and authorized users with legitimate business need
• Consider disabling the loadDict functionality temporarily if it is not critical to operations until the patch can be applied

# Example WAF rule to block SQL injection patterns (ModSecurity format)
SecRule ARGS:keyword "@rx (?i)(union|select|insert|update|delete|drop|;|--|')" \
    "id:1001,phase:2,deny,status:403,msg:'SQL Injection attempt blocked in loadDict keyword parameter'"