This vulnerability involves an SQL injection in the YunaiV yudao-cloud product, specifically affecting the /admin-api/system/mail-log/page endpoint. The injection occurs through manipulation of the toMail argument, enabling remote attackers to execute arbitrary SQL commands. The affected version is 2026.01. The vulnerability has a CVSS 4.0 score of 5.1, reflecting medium severity with network attack vector, low complexity, no user interaction, and partial impact on confidentiality, integrity, and availability. The vendor has not issued any patch or advisory, and the exploit code is publicly accessible.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands remotely via the toMail parameter, potentially leading to unauthorized data access or modification. The impact is limited to partial confidentiality, integrity, and availability loss as per the CVSS vector. No known active exploitation has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor vendor channels for updates. Until a fix is released, restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.