CVE-2026-110609 dromara CVE debrief

Who should care

Defenders responsible for Dromara Skyeye installations, particularly those using versions up to commit 65d3ddcede70, should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the presence of this vulnerability in their systems and apply patches or mitigations as available.

Why it matters

CVE-2026-110609 is a SQL injection vulnerability in Dromara Skyeye that allows authenticated low-privileged users to inject SQL via the keyword parameter. Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available.

• Potential data extraction by attackers
• Possible disruption of service due to database queries
• Need for verification of affected versions and patching status
• Potential lateral movement within the database

Technical summary

The vulnerability is caused by the use of raw ${} substitution in the queryErpOrderItem MyBatis statement, allowing attackers to inject SQL via the keyword parameter. This could potentially allow attackers to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques. The vulnerability affects Dromara Skyeye through commit 65d3ddcede70, and defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available.

Recommended defensive actions

• Verify the presence of this vulnerability in Dromara Skyeye installations
• Apply patches or mitigations as available
• Monitor for suspicious activity related to the queryErpOrderItem MyBatis statement
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. The vulnerability is confirmed to exist in Dromara Skyeye through commit 65d3ddcede70. Defenders should verify the presence of this vulnerability in their systems and apply patches or mitigations as available. The source item provides additional context on the vulnerability, but its scope and impact are still being assessed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.