---
id: "CVE-2026-111686"
kind: "vulnerability"
aliases: ["CVE-2026-111686"]
title: "IceCMS: unauthenticated SQL injection in article lookup exposes database"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "IceCMS", "fixed": [], "affected": "<= 4.1.5 (commit afd7a9f)", "ecosystem": "github"}]
ecosystems: []
tags: ["icecms", "java", "mybatis-plus", "other", "self-hosted", "sql-injection", "unauthenticated"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2026-10-16T18:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:24:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111686", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:24:36+00:00"}]
---

# IceCMS: unauthenticated SQL injection in article lookup exposes database

IceCMS through 4.1.5 (Spring Boot, Apache Shiro, MyBatis-Plus) concatenates the String path variable num into QueryWrapper.last("limit " + num) in GET /WebArticle/findarticlesbynum/{content}/{num}. /WebArticle is not in the Shiro jwt filter chain, so any anonymous caller can append SQL after LIMIT and read the database with union or blind injection. Stacked queries are not available by default (allowMultiQueries not set). No public exploit and no known exploitation. No upstream fix is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:IceCMS affected <= 4.1.5 (commit afd7a9f) fixed ?

## How to check

Exposed if you run IceCMS (any build up to 4.1.5, commit afd7a9f or earlier) and the backend is reachable. Check WebArticleController.java for .last("limit " + num) with num typed String. Safe test on your own instance: GET /WebArticle/findarticlesbynum/a/1%20and%20sleep(3) and see whether the response is delayed. Also check /WebResource/findresourcebynum (CVE-2026-111685). Look for these paths in access logs.

## Fix

No fixed release known (the project has no release tags). Patch the source: make num an Integer and bind it with .last("limit {0}", num), in both WebArticleController and WebResourceController. Until then, block or restrict /WebArticle/findarticlesbynum and /WebResource/findresourcebynum at the reverse proxy or WAF, and run the DB user with least privilege.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111686
- 2026-10-24T00:24:36+00:00 analyst — Correction: removed wrong auth-required tag; flaw is unauthenticated. Sources: VulnCheck advisory, hackmd writeup.

## Documents

- [advisory] VulnCheck: IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webarticle-findarticlesbynum
- [describes] IceCMS unauthenticated SQL injection in WebResource and WebArticle preview-by-num endpoints (static review, no PoC run) https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli
- [describes] WebArticleController.java at afd7a9f (vulnerable sink L169-175) https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/frontend/WebArticleController.java

## From the sources

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_