A vulnerability classified as critical was found in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function
PageRequest of the file yu-picture-backend/src/main/java/com/yupi/yupicturebackend/service/impl/PictureServiceImpl.java of the component MyBatis-Plus. Executing a manipulation of the argument sortField can lead to sql injection.
This vulnerability is tracked as CVE-2026-7060. The attack can be launched remotely. Moreover, an exploit is present.
This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Applying a patch is advised to resolve this issue.
The project was informed of the problem early through a pull request but has not reacted yet.
