Which versions of Yu Picture are affected by EUVD-2026-25730?

CVE-2026-7060 is a critical SQL injection vulnerability in Yu Picture's PageRequest handler that allows unauthenticated attackers to manipulate database queries and compromise confidentiality,…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-25730?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25730. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-25730?

Within 24 hours: identify all instances of Yu Picture in production and development environments; verify current version against vulnerable commit a053632c41340152bf75b66b3c543d129123d8ec. Within 7 days: apply vendor patch from pull request #3 or upgrade to patched version once officially released; test in staging environment before production deployment. Within 30 days: conduct database audit to identify unauthorized access attempts; review application logs for suspicious sortField parameter manipulation; implement Web Application Firewall (WAF) rules to block malicious PageRequest queries during transition period.

Yu Picture EUVD-2026-25730

Q: What is the CVSS score of EUVD-2026-25730?

EUVD-2026-25730 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7060 MEDIUM

SQL Injection (CWE-89)

2026-04-26 VulDB

Java SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 26, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Apr 26, 2026 - 22:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 21:00 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 20:30 euvd

EUVD-2026-25730

Analysis Generated

Apr 26, 2026 - 20:30 vuln.today

Patch released

Apr 26, 2026 - 20:30 nvd

Patch available

CVE Published

Apr 26, 2026 - 20:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java of the component MyBatis-Plus. Executing a manipulation of the argument sortField can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Applying a patch is advised to resolve this issue. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

SQL injection in Yu Picture's PageRequest handler allows remote unauthenticated attackers to manipulate database queries via the sortField parameter in PictureServiceImpl.java. The vulnerability exists in MyBatis-Plus integration code at commit a053632c41340152bf75b66b3c543d129123d8ec. Publicly available exploit code exists (GitHub issue #4) with EPSS not yet calculated. Vendor patch available via pull request #3 but remains unmerged, leaving deployed instances vulnerable. CVSS 7.3 reflects network-accessible, low-complexity exploitation with no authentication required, enabling partial confidentiality, integrity, and availability compromise.

Technical ContextAI

This vulnerability affects Yu Picture (cpe:2.3:a:liyupi:yu-picture), a Java-based image management application. The root cause (CWE-89: SQL Injection) originates in the sortField parameter handling within the PageRequest function of PictureServiceImpl.java. MyBatis-Plus, a popular Java ORM framework extending MyBatis, is used for database operations. The vulnerability occurs when user-controlled sortField input is passed unsanitized into SQL query construction. MyBatis-Plus's dynamic query building features, while powerful, require explicit input validation to prevent injection when accepting external sort parameters. The affected code constructs database queries that incorporate the sortField value without proper parameterization or allowlist validation, enabling attackers to inject arbitrary SQL fragments.

RemediationAI

Primary fix: Apply the patch from GitHub pull request https://github.com/liyupi/yu-picture/pull/3 by manually merging the changes into your deployment, as the vendor has not yet integrated the fix into the main branch. Review the PR diff to understand the input validation added to sortField parameter handling. Workaround if immediate patching is infeasible: Implement application-layer input validation by restricting sortField values to an explicit allowlist of permitted column names (e.g., ['created_time', 'update_time', 'name']) before passing to MyBatis-Plus query builders. Deploy a web application firewall (WAF) rule to block requests containing SQL metacharacters in sortField parameters, though this may cause false positives and is not a substitute for code-level fixes. Side effect consideration: Allowlist validation will break any legitimate custom sort features relying on dynamic column names. Organizations must audit their API usage before deploying restrictive input filters. Long-term: Advocate for the vendor to adopt semantic versioning and merge outstanding security patches to enable standard upgrade workflows.