PT-2026-31587 · Unknown · Jeecgboot Jimureport

Anch0R · Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-5848

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jeecgboot JimuReport versions up to 2.3.0

Description A code injection issue exists in the Data Source Handler component of jeecgboot JimuReport, specifically within the DriverManager.getConnection function located in the /drag/onlDragDataSource/testConnection file. Manipulation of the dbUrl argument can lead to code injection. The attack can be initiated remotely, and the exploit has been made public. The vendor has confirmed the issue and plans to release a fix in a future version.

Recommendations Versions prior to 2.3.0 should be used. As a temporary workaround, consider restricting access to the Data Source Handler component or disabling the affected function until a patch is available.

Exploit

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

CVE-2026-5848

Affected Products

Jeecgboot Jimureport

References · 9

• 🔥 https://github.com/jeecgboot/jimureport/issues/4587 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5848 · Security Note
• https://github.com/jeecgboot/jimureport/issues/4587#issuecomment-4152596778 · Note
• https://vuldb.com/vuln/356374/cti · Note
• https://vuldb.com/vuln/356374 · Note
• https://github.com/jeecgboot/jimureport · Note
• https://vuldb.com/submit/790769 · Note
• https://twitter.com/VulmonFeeds/status/2042198204976906376 · Twitter Post
• https://twitter.com/CVEarity/status/2042538254461997313 · Twitter Post