JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist… (CVE-2026-112017)

JeecgBoot before version 3.9.5 is affected by an SQL injection vulnerability (CVE-2026-112017) that arises because authenticated attackers can circumvent the SqlInjectionUtil keyword blocklist by embedding newline characters in dictionary and online report SQL fragments. This bypass allows attackers to send newline-separated payloads to vulnerable endpoints, enabling boolean or time-based blind SQL injection attacks. Successful exploitation can lead to extraction of sensitive data from the database, including administrator password hashes from the sys_user table. The vulnerability has a CVSS 3.1 score of 6.5, indicating a high severity level. No known exploits in the wild or patch links were provided in the input data.

The vulnerability allows authenticated attackers to bypass input filtering controls and perform blind SQL injection attacks, which can lead to unauthorized disclosure of sensitive database information such as administrator password hashes. This compromises the confidentiality of the system's data but does not affect integrity or availability according to the CVSS vector.

A fix is available in JeecgBoot version 3.9.5 and later. Users should upgrade to version 3.9.5 or newer to remediate this vulnerability. Since no vendor advisory or patch links were provided, verify patch availability and remediation guidance from the official JeecgBoot sources before applying updates.