JeecgBoot CVE-2026-7290

An attacker must possess valid authentication credentials for the JeecgBoot application to access the loadDict endpoint, as indicated by CVSS PR:L (low privilege level required). The endpoint must be enabled and exposed in the application's configuration - dictionary loading is a standard feature in typical JeecgBoot deployments but could be disabled in hardened installations. The application must be running JeecgBoot version 3.9.1 or earlier without the security patch. No special network conditions, user interaction, or non-default configuration are required beyond standard authentication; the vulnerability is exploitable against default endpoint configurations once authenticated.

The CVSS score of 6.3 (Medium severity) combined with CVSS:3.1/E:P (Proof of Concept Exploitability) and publicly disclosed exploit code indicates moderate real-world exploitation risk. The attack vector is network-accessible (AV:N) with low complexity (AC:L), but requires low-level privileges (PR:L), which is a meaningful limiting factor - the attacker must first authenticate to the application. EPSS and KEV status are not provided in the input data, preventing full exploitation probability assessment. The availability of public POC code increases likelihood of opportunistic attacks against unpatched instances, particularly in development environments or those with weak credential controls. The limited scope (S:U) means the impact is confined to the vulnerable component, though confidentiality, integrity, and availability are all affected (C:L/I:L/A:L). Organizations using JeecgBoot should prioritize patching authenticated users with loadDict access; this is not a network-worm scenario but a privilege-escalation or lateral-movement vector for authenticated adversaries.

An authenticated user or an attacker who has obtained valid credentials (e.g., through phishing or credential stuffing) makes an HTTP request to the loadDict endpoint with a crafted keyword parameter containing SQL injection payload, such as keyword=test' UNION SELECT user(),2,3--. The vulnerable SqlInjectionUtil function fails to properly parameterize the query, allowing the injected SQL to execute in the database context, potentially exfiltrating sensitive data from other tables or modifying database state.