PT-2026-38598 · Unknown · Jeecg-Boot

Liaojialin · Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-8114

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.2

Description An issue exists in the JSON Object Handler component where the manipulation of the condition argument in the '/sys/dict/loadTreeData' endpoint allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL statements into a query, potentially allowing them to manipulate or access the database.

Recommendations Update to a version newer than 3.9.1. As a temporary workaround, restrict access to the '/sys/dict/loadTreeData' endpoint or avoid using the condition parameter until the update is applied.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-8114

Affected Products

Jeecg-Boot

References · 9

• 🔥 https://github.com/jeecgboot/JeecgBoot/issues/9571 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8114 · Security Note
• https://vuldb.com/submit/808186 · Note
• https://github.com/jeecgboot/JeecgBoot · Note
• https://t.me/CVEtracker/53047 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052589116806557928 · Twitter Post
• https://vuldb.com/vuln/361902/cti · Note
• https://vuldb.com/vuln/361902 · Note
• https://twitter.com/CVEnew/status/2053559185812435283 · Twitter Post