CVE-2026-5848
jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 9, 2026
- Updated
- Apr 9, 2026
- Reserved
- Apr 8, 2026
Description
A vulnerability was found in jeecgboot JimuReport up to 2.3.0. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source Handler. Performing a manipulation of the argument dbUrl results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
JimuReportjeecgboot |
|
References
- VDB-356374 | jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injectionvdb-entrytechnical-description
- VDB-356374 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #790769 | jeecgboot jimureport <= 2.3.0 Code Injectionthird-party-advisory
- https://github.com/jeecgboot/jimureport/issues/4587exploitissue-tracking
- https://github.com/jeecgboot/jimureport/issues/4587#issuecomment-4152596778issue-tracking
- https://github.com/jeecgboot/jimureport/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.