---
id: "CVE-2026-111390"
kind: "vulnerability"
aliases: ["CVE-2026-111390"]
title: "Erupt: HQL injection lets logged-in users read data outside their tree scope"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["admin-panels", "erupt", "java", "package", "self-hosted"]
not_affected_if: ["no-linktree-scoped-data", "query-permission-restricted"]
published_at: "2026-10-16T12:16:33+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:05:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111390", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Erupt: HQL injection lets logged-in users read data outside their tree scope

Erupt through version 2.3.0 fails to escape quotes in the linkTreeVal parameter of its table data API, so the value is built into an HQL query. An authenticated user with query permission can inject clauses that bypass tree-scoped filters and read data from other mapped entities.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Erupt version in the project's dependency file (for example the `erupt` artifact in `pom.xml` or `build.gradle`); versions up to and including `2.3.0` are listed as affected.
- Look for `linkTree` configurations with String-keyed targets on entities that users can query.

## Fix

- Upgrade Erupt to a release newer than `2.3.0`; the sources do not name the fixed version, so check the project's release page.
- Until patched, restrict query permission on entities that use linkTree filters.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111390

## From the sources

Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_