CVE-2026-111390

Erupt through version 2.3.0 is vulnerable to an HQL injection vulnerability in the Data Table API . The flaw exists because the linkTreeVal parameter in the POST /erupt-api/data/table/{erupt} endpoint fails to sanitize unescaped quotes. This allows authenticated users with query permissions on en...