CVE-2026-7699 is a SQL injection vulnerability affecting Dromara MaxKey up to version 3.5.13. The flaw is located in the StrUtils.checkSqlInjection function within StrUtils.java, where manipulation of the filtersfields argument can lead to injection of malicious SQL commands. This vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. The vendor has not provided a patch or remediation, and public exploit code is available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium with limited confidentiality, integrity, and availability effects. Since the exploit is publicly available, the risk of attack increases despite the medium severity rating.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates and consider implementing application-layer protections such as input validation or web application firewalls to mitigate SQL injection risks. Given the lack of vendor response, cautious exposure of affected versions to untrusted networks is advised. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.