CVE-2026-89310 Details

A SQL injection vulnerability has been identified in JTL WMS MobileServer versions 1.7.0 prior to 2.0.7, as well as in versions 2.1.3 and 2.2.1. The vulnerability arises because a parameter from the request body is inserted into a T-SQL statement without proper parameterization or escaping. This flaw allows remote attackers to execute arbitrary SQL statements within the context of the application's database account. Exploitation of this vulnerability is particularly severe, as the application connects to the database using a highly privileged account, potentially leading to a complete takeover of the database server.

Users can upgrade to JTL WMS MobileServer versions 2.0.7, 2.1.3, or 2.2.1, all released on October 13, 2026. For versions 1.7.0 to 1.11.x, an upgrade to 2.0.7 or newer is the only permanent solution. After updating, no further actions are required.