CVE-2026-8773 Details
Description
A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation of the argument db/password leads to argument injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A critical argument injection vulnerability has been identified in Linlinjava Litemall versions through 1.8.0. The issue arises in the Database Setting Handler, specifically within the backup and load functions of the DbUtil.java file. The vulnerability allows for the injection of additional command-line arguments into mysqldump and mysql commands by manipulating the db or password parameters. This exploitation can be performed remotely, and the vulnerability has been publicly disclosed.
To address this vulnerability, replace the Runtime.exec() method with ProcessBuilder, using an argument array to specify the command and its parameters. This change prevents argument injection by properly handling the command execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 18, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/A1AAAAAAAAAA1/d5ae30a17744459e7cc5902fff32a35b | [email protected] | ExploitRemedy |
| https://vuldb.com/submit/811469 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364398 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364398/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linlinjava litemall | <= 1.8.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | New CVE Received | [email protected] |