{"id":"CVE-2026-125381","kind":"vulnerability","aliases":["CVE-2026-125381"],"related":[],"title":"DataRoom: SQL injection lets sharer-role users run SQL against the database","description":"DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database.","summary":"DataRoom through 3.0.0 builds SQL in MyBatisService.generateSql from crafted dataset parameters without proper escaping. A user with the sharer role can send crafted inputParam values to /dataRoom/dataset/run and execute injected SQL against the database.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dataroom","mysql","other","sql"],"not_affected_if":["dataroom-newer-than-3.0.0","no-sharer-role-users"],"how_to_check":"- Check the installed DataRoom version against the affected range (through 3.0.0).\n- Look for the /dataRoom/dataset/run endpoint in your deployment and review who holds the sharer role.","fix":null,"status":"open","published_at":"2026-11-10T00:17:11+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:30:27+00:00","updated_at":"2026-11-10T00:30:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"DataRoom: SQL injection lets sharer-role users run SQL against the database","impact":"high","summary":"DataRoom through 3.0.0 builds SQL in MyBatisService.generateSql from crafted dataset parameters without proper escaping. A user with the sharer role can send crafted inputParam values to /dataRoom/dataset/run and execute injected SQL against the database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dataroom","sql","mysql"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"SQL injected into the database; data read or changed","analyst_note":"Patch link is on github.com and the advisory is on vulncheck.com; confirm the fixed version and whether the sharer role is required by default.","how_to_check":"- Check the installed DataRoom version against the affected range (through 3.0.0).\n- Look for the /dataRoom/dataset/run endpoint in your deployment and review who holds the sharer role.\n- unknown for other checks; the sources do not name a configuration to inspect.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sharer-role-users","dataroom-newer-than-3.0.0"],"who_is_affected":"DataRoom deployments at version 3.0.0 or earlier are exposed, and the flaw needs an account with the sharer role. Teams running DataRoom should check who holds that role and whether the dataset run endpoint is reachable by them. Teams not running DataRoom can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4626,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125381':16A,19A '-2026':15A,18A '/dataroom/dataset/run':50B,89C '3.0.0':26B,60C 'allow':69C 'attack':82C 'backslash':96C 'build':27B 'contain':61C 'craft':32B,46B,79C,85C 'cve':14A,17A 'databas':13A,57B,104C 'dataroom':1A,20B,24B,58C 'dataset':33B,80C 'escap':37B,97C 'execut':52B,99C 'exploit':90C 'inject':3A,53B,64C,75C,100C 'inputparam':47B,86C 'let':4A 'mybatisservice.generatesql':30B,67C 'mysql':21B,95C 'paramet':34B,81C,93C 'proper':36B 'role':7A,43B,72C 'run':9A 'send':45B,84C 'sharer':6A,42B,71C 'sharer-rol':5A,70C 'sql':2A,10A,23B,28B,54B,63C,76C,101C 'string':92C 'suppli':78C 'unquot':91C 'user':8A,39B,73C 'valu':48B,87C 'vulner':65C 'without':35B","nicknames":[],"mitigations":[],"who_affected":"DataRoom deployments at version 3.0.0 or earlier are exposed, and the flaw needs an account with the sharer role. Teams running DataRoom should check who holds that role and whether the dataset run endpoint is reachable by them. Teams not running DataRoom can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dataroom","medium","mysql","other","sql"],"campaign_type":null,"search_a":"'-125381':16A,19A '-2026':15A,18A 'cve':14A,17A 'databas':13A 'dataroom':1A 'inject':3A 'let':4A 'role':7A 'run':9A 'sharer':6A 'sharer-rol':5A 'sql':2A,10A 'user':8A","search_b":"'/dataroom/dataset/run':50B '3.0.0':26B 'build':27B 'craft':32B,46B 'databas':57B 'dataroom':20B,24B 'dataset':33B 'escap':37B 'execut':52B 'inject':53B 'inputparam':47B 'mybatisservice.generatesql':30B 'mysql':21B 'paramet':34B 'proper':36B 'role':43B 'send':45B 'sharer':42B 'sql':23B,28B,54B 'user':39B 'valu':48B 'without':35B","search_c":"'/dataroom/dataset/run':89C '3.0.0':60C 'allow':69C 'attack':82C 'backslash':96C 'contain':61C 'craft':79C,85C 'databas':104C 'dataroom':58C 'dataset':80C 'escap':97C 'execut':99C 'exploit':90C 'inject':64C,75C,100C 'inputparam':86C 'mybatisservice.generatesql':67C 'mysql':95C 'paramet':81C,93C 'role':72C 'send':84C 'sharer':71C 'sharer-rol':70C 'sql':63C,76C,101C 'string':92C 'suppli':78C 'unquot':91C 'user':73C 'valu':87C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125381","severity":null,"published_at":"2026-11-10T00:17:11+00:00","modified_at":"2026-11-10T00:17:11+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111545,"url":"https://github.com/gcpaas/DataRoom/commit/d155312b23a91e39e5e934e3e2d2deede650b92b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111546,"url":"https://www.vulncheck.com/advisories/dataroom-through-3.0.0-sql-injection-via-mybatisservice-generatesql","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}