CVE-2026-7678
Description
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An authenticated SQL injection vulnerability in YunaiV yudao-cloud up to 2026.01 allows attackers with a specific permission to execute arbitrary SQL via the getDataBySQL method.
Vulnerability
Description
A SQL injection vulnerability exists in YunaiV yudao-cloud, a popular microservice development framework, up to version 2026.01. The flaw resides in the getDataBySQL method within GoViewDataServiceImpl.java. The method directly concatenates user-supplied SQL input into a jdbcTemplate.queryForRowSet() call without any parameterization or input validation, allowing an attacker to inject arbitrary SQL commands [1].
Exploitation
The vulnerability is exploitable remotely via the API endpoint POST /admin-api/report/go-view-data/get-by-sql. However, exploitation requires authentication and the specific permission report:go-view-data:get-by-sql. An attacker who has obtained these credentials or privileges can send crafted SQL payloads in the request body to the vulnerable endpoint [1].
Impact
Successful exploitation allows an authenticated attacker to execute arbitrary SQL queries against the underlying database. This can lead to unauthorized reading, modification, or deletion of sensitive data, and potentially full compromise of the database server. The CVSS v3.1 base score assigned by the reporter is 8 reporter is 8.6 (High), though the official NVD CVSS v3 score is 6.3 (Medium) [1].
Mitigation
As of the disclosure date, the vendor (YunaiV) has not responded to the report, and no official patch or workaround has been released. Users of affected versions (up to 2026.01) should apply strict input validation or disable the vulnerable endpoint if possible, pending a vendor fix [1].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <=2026.01
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.