JEECGBOOT · CVE-2026-124554 · Package
NO FIX YET
A flaw in the JimuBI component of JeecgBoot 3.9.5 lets a remote attacker inject SQL through the params argument of the getAllChartData endpoint. A public exploit exists, so an attacker could read or change database contents.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
JeecgBoot 3.9.5 installations that expose the JimuBI chart endpoint are affected, and the sources say remote exploitation is possible. The sources do not say whether authentication or a non-default setting is required. Teams running other versions or without JimuBI can likely skip it, but the sources do not confirm this.
Not affected if other-versions
Who cares java, jeecgboot, self-hosted
Unknown from the sources.
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.