CVE-2026-36418: JimuReport versions 2

Synopsis

Remote code execution vulnerability in JimuReport versions 2.3.4 and below allows unauthenticated network attackers to run arbitrary code on the server. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without validation, so any attacker who can reach the service over the network can craft a malicious expression payload. Successful exploitation gives the attacker arbitrary code execution on the host, with full read and write access to data the process can reach. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the JimuReport service.

• AuthenticationNot required

  The /jmreport/executeSelectApi endpoint accepts unauthenticated requests, so no account or credential is needed to submit a malicious payload.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or interaction is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or specific memory layout to succeed.

Blast Radius

• Attacker executes arbitrary code in the context of the JimuReport server process, gaining full control over whatever the process is permitted to do on the host.
• Attacker reads any data accessible to the server process, including configuration files, credentials, database connection strings, and stored report data.
• Attacker writes or modifies files and data reachable by the server process, including report definitions, application configuration, and any writable storage.