CVE-2026-7699 is a SQL injection vulnerability affecting Dromara MaxKey versions 3.5.0 through 3.5.13. The flaw exists in the StrUtils.checkSqlInjection function of StrUtils.java, where manipulation of the filtersfields argument can lead to injection of malicious SQL commands. This vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor was notified but has not issued any patch or mitigation guidance. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized data access or modification. The impact is rated as medium due to the limited scope of confidentiality, integrity, and availability impacts and the requirement of some privileges. The public availability of an exploit increases the risk of attacks, although no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing application-level input validation or filtering on the filtersfields parameter to mitigate injection risks. Monitoring for unusual database queries and restricting database permissions may also reduce potential impact until an official fix is available.