CVE-2026-4594 | erupts erupt up to 1.13.3 EruptJpaUtils.java geneEruptHqlOrderBy sort.field sql injection

A vulnerability categorized as critical has been discovered in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java. Such manipulation of the argument sort.field leads to sql injection hibernate.

This vulnerability is referenced as CVE-2026-4594. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.