Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111447

Quick assessment

Affected
Wheels Wheels
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Wheels 框架 1.1 至 4.1.2 版本中， 方法在解析记录时，仅依据提交的主键进行匹配，而未验证该记录是否属于当前正在保存的父记录。因此，能够提交嵌套表单的用户，可以更新或重新分配其他父记录的 或 关联行；若启用了 ，甚至可删除这些行。此外，通过提交其他关联记录的主键，用户还能编辑嵌套的 记录。对于由非外键组成的复合主键的新子记录，系统会保留提交的主键值，从而允许请求方自行指定其身份。该问题已在 4.2.0 版本中修复。

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111447

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变Web参数的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Wheels Wheels 1.1.0 ~ 4.2.0 -

II. Public POCs for CVE-2026-111447

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111447

请登录查看更多情报信息。

Other References for CVE-2026-111447 (1)

Same Patch Batch · Wheels · 2026-10-16 · 9 CVEs total

CVE-2026-111444 9.8 CRITICAL Wheels 4.1.2 存在 SQL 注入漏洞
CVE-2026-111446 8.6 HIGH Wheels 4.0.0-4.1.2 未授权访问漏洞
CVE-2026-111445 8.1 HIGH Wheels 4.0.0-4.1.2 存在越权漏洞
CVE-2026-111451 7.8 HIGH Wheels CLI 4.0.0-4.1.1 远程代码执行与文件覆盖漏洞
CVE-2026-111443 6.5 MEDIUM Wheels 4.0.6-4.1.2 上下文切换漏洞
CVE-2026-111450 5.9 MEDIUM Wheels 4.1.1 冷启动 Host 头漏洞致信息泄露
CVE-2026-111449 5.9 MEDIUM Wheels 4.1.1 之前版本存在敏感信息泄露漏洞
CVE-2026-111448 3.7 LOW Wheels 4.0.0-4.1.2 路径遍历漏洞

IV. Related Vulnerabilities

Same product: Wheels
Same vendor: Wheels
Same weakness: CWE-472

V. Comments for CVE-2026-111447

No comments yet

Leave a comment