CVE-2026-2682 is a SQL injection (CVSS 6.3, medium) in Tsinghua Unigroup Electronic Archives System up to version 3.2.210802(62532), through the comid argument of a report page. The vendor did not respond to the disclosure and no fix is confirmed, so restrict access to the application.
What's affected
The record names Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The vulnerable file is /mine/PublicReport/prinReport.html?token=java and the argument is comid.
The record says the vendor was contacted early and did not respond. No patched version is listed. The record also says an exploit has been publicly disclosed.
How to check if you're exposed
Find the version in the application's about page or your install records. Anything up to 3.2.210802(62532) is in the affected range.
Then look at the web server logs for requests to the prinReport page with unusual comid values, and ask who can reach the application from outside your network.
What to do now
- Confirm whether you run this product and which build.
- Put the application behind a VPN or an allow list so it is not open to the internet.
- Place a web application firewall rule on the report endpoint as a stopgap, and test that it does not break normal use.
- Contact the vendor through your account channel and ask for a fixed build in writing.
- Review the database account used by the application and cut its privileges to the minimum.
Why it matters
The record lists CWE-89 (SQL injection) and CWE-74 (injection in general). A request value is joined into a database query, so crafted input can change what the query does. The CVSS vector needs low privileges and gives limited impact on each of confidentiality, integrity and availability, which explains the medium score.
Archive systems hold records people expect to be tamper proof. A weak data layer undermines that, and an unresponsive vendor leaves you to compensate with network controls.
Quick check
Is there a patch?
None is listed in the record, and the vendor did not respond. Use access controls until that changes.
Sources
- CVE-2026-2682 on Gold
- NVD record for CVE-2026-2682, published 18 February 2026
- VulDB entry listed in the record: https://vuldb.com/?id.346473
Last reviewed: 19 October 2026.
