A vulnerability was detected in erzhongxmu Jeewms up to 3.7. (CVE-2026-108684)

The vulnerability (CVE-2026-108684) affects erzhongxmu Jeewms versions up to 3.7 in the getTreeData function located in src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java. The flaw is a SQL injection caused by improper handling of the searchVal argument in the Autocomplete Data Handler component. An attacker with network access and low privileges can remotely exploit this vulnerability to execute unauthorized SQL commands. The issue is addressed by a patch referenced as 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0.

Successful exploitation could lead to unauthorized reading or modification of database contents, impacting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score of 6.3 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required. Privileges required are low, indicating that an attacker with limited access could exploit this remotely.

A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is available and should be applied to fix the vulnerability. No additional vendor advisory content is provided, so patch status beyond this commit reference is not confirmed. It is recommended to apply the patch promptly to mitigate the risk.