CVE-2026-2954 is a medium severity flaw (CVSS 6.3) in Dromara UJCMS 10.0.2. The channel import function in the data import controller takes the driverClassName and url arguments in a way that allows injection. It can be attempted remotely by an authenticated user, and the exploit is public.
What's affected
The NVD record lists Dromara UJCMS version 10.0.2. The NVD record does not name a fixed version, so assume every copy you run is exposed until the maintainer says otherwise. The vendor was contacted early about this disclosure but did not respond, according to the record. The public disclosure and the record are the only sources for this issue.
How to check if you're exposed
Find out whether Dromara UJCMS 10.0.2 runs anywhere in your environment, including test servers and old demos. Check your UJCMS version in the admin panel and compare it with 10.0.2. The import path is /api/backend/ext/import-data/import-channel.
Then check who can reach it. A copy that is open to the internet is the case that matters most, so review the web server, reverse proxy and firewall rules for that host.
What to do now
- Remove Dromara UJCMS 10.0.2 from any internet-facing host, or restrict it to a trusted network or VPN.
- Check the project page and the maintainer's contact channels for a fix, and apply it if one has appeared since this was written.
- Restrict the back office API to trusted users and networks.
- Limit the accounts that can use data import features, and review who holds them.
- Review the database connections the application has configured, and remove any you do not recognise.
- Keep a list of small third party applications like this one, so a new advisory can be matched against it quickly. The Gold page for this CVE has the latest data: https://gold.safeguard.sh/vulnerability/CVE-2026-2954
Why it matters
The record files this under CWE-707 and CWE-74. The record files this under CWE-74 and CWE-707, which describe a failure to neutralise special elements before data reaches another component. In this case the arguments name a database driver and address, so user input steers how the server connects out. Features that let a user pick a driver or URL need an allowlist on the server. That fix belongs to the maintainer.
The NVD description says the exploit is public, so anyone can read how the weakness works. A public write-up and no vendor fix is a poor mix for a system that holds real data, which is why exposure control is the main defence here. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Does this need a login?
The CVSS vector lists low privileges, so a signed-in user is enough.
Is there a patch?
The record names none, and the vendor did not respond.
Sources
Last reviewed: 19 October 2026.
