CVE-2026-110614: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Yiuman citrus

CVE-2026-110614 describes an improper neutralization of special elements in an SQL command (SQL injection) vulnerability in Yiuman citrus through version 0.15.0. The issue exists in the citrus-support generic query framework where the sortBy request parameter is not properly sanitized, allowing attackers to append arbitrary SQL to the ORDER BY clause. This affects any generic list route of controllers extending BaseQueryController or BaseQueryRestful. Attackers can exploit this to extract database contents using boolean- or time-based blind SQL injection techniques.

Successful exploitation allows an attacker with low privileges to inject malicious SQL code into the ORDER BY clause of database queries, potentially leading to unauthorized data extraction from the backend database. The vulnerability does not require user interaction and has a high impact on confidentiality (VC:H) but no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing affected endpoints to untrusted users or implement strict input validation and parameterization on the sortBy parameter to prevent injection.