{"id":"CVE-2026-111390","summary":"Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API","details":"Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.","modified":"2026-10-17T02:48:55.098948829Z","published":"2026-10-16T11:38:02.147Z","database_specific":{"cwe_ids":["CWE-564"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111390.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111390.json"},{"type":"PACKAGE","url":"https://github.com/erupts/erupt"},{"type":"ARTICLE","url":"https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/service/EruptService.java#L62-L71"},{"type":"ARTICLE","url":"https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/util/TypeUtil.java#L107-L115"},{"type":"ARTICLE","url":"https://github.com/erupts/erupt/blob/2.3.0/erupt-data/erupt-data-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java#L210-L212"},{"type":"ADVISORY","url":"https://hackmd.io/m0EK1XcGQfua6QHIXXNqMQ"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111390"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/erupt-through-2.3.0-hql-injection-via-linktreeval-in-data-table-api"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/erupts/erupt","events":[{"introduced":"0"},{"last_affected":"f9f1fe1a73c8cdafd4c8c697ced6ff423c276692"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2.3.0"}],"source":"AFFECTED_FIELD"}}],"versions":["2.3.0","2.2.0","2.1.1","2.1.0","2.0.4","2.0.3","2.0.1","2.0.0","1.14.3","1.14.2","1.14.1","1.13.3","1.13.2","1.13.1","1.12.23","1.12.21","1.12.20","1.12.19","1.12.18","1.12.17","1.12.16","1.12.15","1.12.14","1.12.13","1.12.12","1.12.11","1.12.10","1.12.9","1.12.8","1.12.7","1.12.5","1.12.4","1.12.3","1.12.2","1.12.1","1.12.0","1.11.7","1.11.6","1.11.5","1.11.4","1.11.3","1.11.2","1.11.1","1.10.15","1.10.14","1.10.13","1.10.12","1.10.11","1.10.10","1.10.9","1.10.8","1.10.7","1.10.6","1.10.5","1.10.4","1.10.3","1.10.1","1.9.3","1.9.2","1.9.1","1.9.0","1.8.5","1.8.4","1.8.3","1.8.2","1.8.1","1.8.0","1.7.3","1.7.2","1.7.1","1.7.0","1.6.16","1.6.15","1.6.14","1.6.13","1.6.12","1.6.11","1.6.10","1.6.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111390.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}