CVE-2026-111390: erupt 0 through 2.3.0

Affected technology

erupt · 0 through 2.3.0
erupts

Description’s affected range: through 2.3.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated users can bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Vendor/CNA’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as high; integrity and availability impact as none.