Dromara MaxKey EUVD-2026-26837

Exploitation requires valid low-privilege authentication credentials to the Dromara MaxKey instance (PR:L in CVSS vector). The attacker must have network access to the MaxKey application interface and knowledge of or ability to identify the specific API endpoint or function that invokes StrUtils.checkSqlInjection with the filtersfields parameter. The SQL injection payload is executed at the privilege level of the MaxKey database connection, which may exceed the privilege level of the authenticated user. No special non-default configuration is explicitly documented in the CVE description, suggesting the vulnerability exists in standard deployments.

The risk profile presents conflicting signals that warrant careful interpretation. The CVSS score of 6.3 with network attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L) indicates moderate severity for authenticated attackers. The EPSS data is absent, preventing exploitation probability correlation. Critically, the KEV status is not confirmed in the provided data, but the public availability of exploit code (POC=YES) significantly elevates real-world risk despite the moderate CVSS score. The requirement for low-privilege authentication (PR:L) is the primary limiting factor - this is not an unauthenticated remote code execution vulnerability. However, in identity and access management systems like MaxKey, low-privilege accounts may be numerous and easier to compromise than high-privilege ones. The vendor's non-response to early disclosure and the rapid public release of exploits suggest this is actively being leveraged. The decision to prioritize this should balance the moderate CVSS against confirmed POC availability and low authentication barriers in typical MaxKey deployments. This is a genuine security priority for MaxKey deployments rather than a high-CVSS-but-low-real-risk issue.

An attacker with a low-privilege MaxKey account crafts an HTTP request with a malicious SQL injection payload in the filtersfields parameter targeting the StrUtils.checkSqlInjection function. The function fails to properly sanitize the input, allowing the attacker's SQL code to execute within the database context. The attacker then extracts sensitive authentication credentials, user account data, or configuration secrets stored in the MaxKey database, or modifies user privileges to escalate access within the identity management system.