CVE-2026-111686: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Thecosy IceCMS

CVE-2026-111686 is an unauthenticated SQL injection vulnerability in Thecosy IceCMS through version 4.1.5. The issue arises from improper neutralization of special elements in the num path parameter of the /WebArticle/findarticlesbynum endpoint. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper, enabling extraction of database contents via union-based or blind SQL injection techniques. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with attack vector network, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows remote attackers to extract sensitive database information without authentication. The vulnerability compromises confidentiality by enabling unauthorized data disclosure. There is no indication of impact on integrity or availability in the provided data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Thecosy vendor advisories for updates. Until a fix is available, restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts may help mitigate risk.