---
id: "CVE-2026-124554"
page: "https://infrastack.ai/live/CVE-2026-124554"
kind: "vulnerability"
aliases: ["CVE-2026-124554"]
title: "JeecgBoot: JimuBI chart endpoint lets remote users run SQL injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "JeecgBoot", "fixed": [], "affected": "3.9.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "jeecgboot", "package", "self-hosted"]
not_affected_if: ["other-versions"]
published_at: "2026-11-09T02:16:59+00:00"
first_seen_at: "2026-11-09T02:24:16+00:00"
updated_at: "2026-11-09T02:26:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124554", "first_seen_at": "2026-11-09T02:24:16+00:00"}, {"source": "analyst", "url": "https://github.com/jeecgboot/JeecgBoot/releases", "first_seen_at": "2026-11-09T02:26:57+00:00", "cites": ["https://github.com/jeecgboot/JeecgBoot/releases"]}]
exploit_sources: []
---

# JeecgBoot: JimuBI chart endpoint lets remote users run SQL injection

Link for people: https://infrastack.ai/live/CVE-2026-124554 (this .md is for agents)

A flaw in the JimuBI component of JeecgBoot 3.9.5 lets a remote attacker inject SQL through the params argument of the getAllChartData endpoint. A public exploit exists, so an attacker could read or change database contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JeecgBoot affected 3.9.5 fixed no fixed version listed

## How to check

- Confirm the installed JeecgBoot version is 3.9.5 (the only version named in the record)
- Check whether /jeecg-boot/drag/onlDragDatasetHead/getAllChartData is reachable from outside your network
- Also check if you run a newer build: v3.9.6 upgrades Jimu BI to 2.5.6.1 but its notes do not say this issue is fixed

## Timeline

- 2026-11-09T02:24:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124554
- 2026-11-09T02:26:57+00:00 analyst https://github.com/jeecgboot/JeecgBoot/releases — Exa out of credits, NVD page unreadable via WebFetch; no vendor advisory found. JeecgBoot releases page shows v3.9.6 (Nov 5) upgrading Jimu BI to 2.5.6.1 and hardening SQLi generally, but does not name this endpoint/CVE, so no fix claimed. Nothing verified. Exploit/auth requirement unconfirmed (CVSS vector says PR:N, E:P per VulDB). Revisit with working search.

## Documents

- [mentions] JeecgBoot releases (v3.9.6 notes: Jimu BI 2.5.6.1, no mention of getAllChartData) https://github.com/jeecgboot/JeecgBoot/releases

## From the sources

A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_