---
id: "CVE-2026-112017"
kind: "vulnerability"
aliases: ["CVE-2026-112017"]
title: "JeecgBoot: newline characters bypass SQL keyword filter, enabling blind injection"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "jeecgboot", "package", "self-hosted", "sql"]
not_affected_if: ["version-3.9.5-or-later"]
published_at: "2026-10-18T12:17:14+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:36:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112017", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# JeecgBoot: newline characters bypass SQL keyword filter, enabling blind injection

JeecgBoot versions before 3.9.5 filter SQL keywords in dictionary and online report fragments, but inserting newline characters gets past that blocklist. A logged-in attacker can send such payloads to endpoints like /sys/dict/getDictItems and extract database contents, including administrator password hashes from sys_user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JeecgBoot version against `3.9.5`; anything earlier is in scope.
- Confirm whether the dictionary or online report endpoints such as `/sys/dict/getDictItems` are reachable by user accounts.
- unknown for a specific command or config check beyond the version.

## Fix

- Upgrade JeecgBoot to `3.9.5` or later.
- Rotate administrator and user password hashes and sessions if exposure is suspected.
- unknown for any workaround beyond upgrading.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112017

## From the sources

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_