CVE-2026-37216 Details

A stored cross-site scripting vulnerability has been identified in Ruoyi version 4.8.2, specifically within the notice management interface. The issue arises because the application.yml file excludes the /system/notice/* path from XSS filtering to accommodate HTML submissions via the Summernote rich text editor. However, the server fails to sanitize the incoming HTML, allowing users with the appropriate permissions to inject malicious JavaScript. This injected script is executed in the browsers of all users who view the notice, including other administrators. Furthermore, the absence of CSRF protection enables exploitation of this XSS vulnerability to silently interact with administrative functions, such as creating a backdoor account.

To address this vulnerability, it is recommended to sanitize the HTML content of notices before saving them. This can be done using a library like JSoup to remove harmful elements while allowing safe formatting tags. Additionally, the XSS exclusion in the application.yml file can be maintained, as long as proper sanitization is implemented.