CVE-2026-2954 | Dromara UJCMS 10.0.2 ImportDataController import-channel importChanel driverClassName/url injection

A vulnerability was found in Dromara UJCMS 10.0.2. It has been rated as critical. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection.

This vulnerability is cataloged as CVE-2026-2954. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.