CVE-2026-111634

HighCVSS 8.1

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.

Risk Assessment

An authenticated viewer can read unexposed tables and modify data in the report's data source, compromising data confidentiality and integrity.

Recommendation

Upgrade Helical Insight beyond 7.0.0 and fix the SqlDetect guard and use parameterized queries to prevent SQL injection.

Other vulnerabilities in Helical Insight

CVE-2026-111635Medium
Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS