A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-picture…

A SQL injection vulnerability (CVE-2026-7060) was discovered in the liyupi yu-picture application up to commit a053632c41340152bf75b66b3c543d129123d8ec. The vulnerability affects the PageRequest function in the PictureServiceImpl.java file of the MyBatis-Plus component. Attackers can exploit this by manipulating the sortField argument to perform SQL injection attacks remotely. The exploit has been publicly disclosed and is available for use. The project maintainers have been notified through a pull request but have not responded yet. A patch is recommended to resolve this security issue.