The vulnerability CVE-2026-7060 affects liyupi yu-picture up to commit a053632c41340152bf75b66b3c543d129123d8ec. It is located in the PageRequest function within yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java, which uses MyBatis-Plus. Improper handling of the sortField argument allows an attacker to perform SQL injection remotely without authentication. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. No official patch or fix is currently available, and the vendor has not reacted to early reports.

Successful exploitation of this vulnerability can allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or disruption of service. Since no patch is available and the product lacks versioning, affected users cannot currently remediate via updates. The exploit has been publicly disclosed, increasing the risk of exploitation.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates and consider implementing temporary mitigations such as input validation or restricting access to the vulnerable function if possible. Since the vendor has not yet responded to the issue, caution and defensive coding practices are advised until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.