Is there a public PoC exploit available for EUVD-2026-20858?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20858. Prioritise patching immediately. EPSS: 0.1%.

Jimureport EUVD-2026-20858

Q: What is the CVSS score of EUVD-2026-20858?

EUVD-2026-20858 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-5848 LOW

Code Injection (CWE-94)

2026-04-09 VulDB

GHSA-883j-v822-6wwv

Code Injection RCE Jimureport

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 05:45 euvd

EUVD-2026-20858

Analysis Generated

Apr 09, 2026 - 05:45 vuln.today

CVE Published

Apr 09, 2026 - 05:15 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was found in jeecgboot JimuReport up to 2.3.0. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source Handler. Performing a manipulation of the argument dbUrl results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirmed the issue and will provide a fix in the upcoming release.

AnalysisAI

Code injection in JimuReport's Data Source Handler allows authenticated high-privilege users to execute arbitrary code via manipulated dbUrl parameters in the DriverManager.getConnection function (versions up to 2.3.0). The vulnerability requires high-privilege authentication but can be exploited remotely with low attack complexity; publicly available exploit code exists and the vendor has acknowledged the issue with a fix planned for an upcoming release.

Technical ContextAI

JimuReport's Data Source Handler component processes database connection strings through the DriverManager.getConnection function without proper sanitization of the dbUrl parameter. The vulnerability falls under CWE-94 (Code Injection), allowing attackers to inject malicious code that gets interpreted during database connection initialization. The vulnerability affects the /drag/onlDragDataSource/testConnection endpoint, which is accessible via the web interface. JimuReport is a visual report design and data visualization tool used in the JeeConfig framework; affected versions range from those prior to 2.3.0 according to the CPE specification cpe:2.3:a:jeecgboot:jimureport:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade JimuReport to a version released after the vendor's confirmed fix; the exact patched version number is not specified in available data, so monitor the official repository and release notes at https://github.com/jeecgboot/jimureport/ for the next available release containing the security patch. In the interim, restrict access to the /drag/onlDragDataSource/testConnection endpoint to trusted administrators only, implement network-level access controls to limit who can reach the Data Source Handler component, and audit database connection configurations for suspicious or unexpected dbUrl parameter values. Consider disabling the test connection feature if it is not actively required for operations.