CVE-2026-125381

Description

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/gcpaas/DataRoom/issues/25 ↗
• https://github.com/gcpaas/DataRoom ↗
• https://github.com/gcpaas/DataRoom/blob/3.0.0/dataRoomServer/src/main/java/com/gccloud/gcpaas/dataroom/core/dataset/service/MyBatisService.java#L38-L66 ↗
• https://github.com/gcpaas/DataRoom/commit/d155312b23a91e39e5e934e3e2d2deede650b92b ↗
• https://www.vulncheck.com/advisories/dataroom-through-3.0.0-sql-injection-via-mybatisservice-generatesql ↗