CVE-2026-37216: XSS

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Configuration

   Disable the /system/notice/add endpoint, or restrict it to trusted administrator accounts or internal IPs until an official fix is available.

   Ruoyi /system/notice/add endpoint = disabled or access-restricted
2. Configuration

   Implement strict server-side input validation and output encoding/escaping for all user-supplied fields handled by /system/notice/add to prevent XSS payloads from being stored or reflected.

   Ruoyi input validation/output encoding for notice content = apply strict input validation and HTML output encoding/escaping
3. Compensating control

   Deploy a WAF or web filtering rules to detect and block XSS payloads targeting /system/notice/add, and enforce network/firewall rules to limit access to the endpoint to trusted networks or management hosts.

4. Operational

   Audit existing notices created via /system/notice/add for embedded scripts or malicious content; remove or sanitize any discovered entries and monitor logs for attempted exploitation.

Event History

Frequently Asked Questions