CVE-2026-5848
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was found in jeecgboot JimuReport up to 2.3.0 in the DriverManager.getConnection function of the file /drag/onlDragDataSource/testConnection in the Data Source Handler component. Manipulation of the dbUrl argument results in code injection, and the exploit has been made public.
Risk Assessment
A remote attacker could perform code injection by controlling the dbUrl parameter, potentially leading to system compromise.
Recommendation
Apply the fix in the upcoming release confirmed by the vendor or restrict access to the connection testing functionality.
Other vulnerabilities in JimuReport
See all- CVE-2026-36418Critical
JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute arbitrary code.
- CVE-2025-66913Critical
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.
- CVE-2026-75479High
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.
- CVE-2026-58375High
JimuReport up to version 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication. The @JimuNoLoginRequired annotation causes all access controls to be skipped, and the export service streams the report for any given ID without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including data from SQL queries and credentials embedded in data sources.
Original NVD description (English source)
A vulnerability was found in jeecgboot JimuReport up to 2.3.0. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source Handler. Performing a manipulation of the argument dbUrl results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS