CVE-2026-8773

Vulnerability

A security vulnerability exists in linlinjava litemall up to version 1.8.0. The backup() and load() functions in litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java directly concatenate the db and password parameters into a Runtime.exec() call without sanitization. This allows argument injection into the mysqldump and mysql commands. The affected code path is reachable via the Database Setting Handler, which can be triggered remotely [1].

Exploitation

An attacker can exploit this vulnerability by sending crafted db or password parameters to the backup/load functionality. No authentication is required if the handler is exposed. The attacker injects additional command-line arguments (e.g., --result-file) into the executed command. The proof-of-concept demonstrates that injecting --result-file=/tmp/arbitrary_file.txt via the db parameter creates a file on the server [1].

Impact

Successful exploitation allows an attacker to write arbitrary files to the server's filesystem with the privileges of the application process. This could lead to further compromise, such as overwriting configuration files or planting malicious code. The impact is limited to file write; no remote code execution is demonstrated in the available references [1].

Mitigation

As of the publication date, the vendor has not responded to disclosure and no patch is available. Users should restrict network access to the Database Setting Handler, sanitize all input parameters, or avoid using Runtime.exec() with string concatenation. Affected versions are linlinjava/litemall up to 1.8.0 [1].