Attack Chain

1. Attacker identifies a ReactPress instance exposed to the internet.
2. Attacker inspects the API structure and identifies susceptible GET endpoints (/api/article, /api/comment, /api/file, /api/page, /api/Knowledge).
3. Attacker crafts an HTTP GET request containing malicious SQL fragments within a query parameter key (e.g., ?some_col=value is replaced with ?1=1;--=value).
4. The ReactPress server parses the query parameter key and dynamically constructs a TypeORM QueryBuilder statement using the malicious key as a column identifier.
5. The resulting unsanitized query is sent to the underlying database driver.
6. The database executes the injected SQL commands alongside legitimate queries.
7. Attacker uses boolean-based or time-based blind SQL injection techniques to extract data character by character based on the server response or latency.

Impact

Successful exploitation results in unauthorized access to the application database. An attacker can exfiltrate sensitive information, including user records, system configurations, API keys, and article contents. The vulnerability is highly impactful due to its unauthenticated nature, allowing complete compromise of the database layer.

Recommendation

• Upgrade to @fecommunity/reactpress version 3.7.0 or higher immediately to patch CVE-2026-61685.
• If upgrading is not immediately possible, implement a WAF or API gateway rule to inspect and reject incoming HTTP GET requests that contain suspicious SQL syntax or illegal characters within query parameter keys.
• Implement strict allow-listing for all query parameters accepted by the API endpoints listed in this brief.