CVE-2026-7678 Details
Description
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: "[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched."
A SQL injection vulnerability has been identified in YunaiV yudao-cloud versions prior to 2026.01. The issue resides in the 'getDataBySQL' method of the 'GoViewDataServiceImpl' class, within the 'yudao-module-report-biz' module. This vulnerability allows authenticated users with the 'report:go-view-data:get-by-sql' permission to execute arbitrary SQL queries. The 'getDataBySQL' method directly executes user-provided SQL without proper validation or parameterization, enabling attackers to inject malicious SQL code. Exploitation of this vulnerability could lead to unauthorized data access, data manipulation, and database compromise.
It is recommended to implement parameterized queries to prevent SQL injection. If direct SQL execution is necessary, validate the SQL against a whitelist of allowed patterns before execution. Alternatively, consider removing the endpoint entirely and using prepared statements or stored procedures instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 3, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/9str0IL/CVE/issues/2 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-7678 | [email protected] | |
| https://vuldb.com/submit/800865 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360831 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360831/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YunaiV yudao-cloud | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | [email protected] |
| Oct 26, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 3, 2026 | New CVE Received | [email protected] |