CVE-2026-38812: SQL Injection
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
RuoYi code generation modulefrom your environment.Uninstall or remove the code generation module that exposes /tool/gen/createTable if the functionality is not needed.
- Configuration
Disable the code generation module or disable the /tool/gen/createTable endpoint if code generation functionality is not required.
RuoYi code generation module (/tool/gen/createTable) enabled = false - Compensating control
Restrict access to the /tool/gen/createTable endpoint to trusted administrator IPs/networks using firewall rules, an access control list, or a web application firewall to limit exposure until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38812?
CVE-2026-38812 has a critical severity rating of 9.8 according to CVSS 3.1.
How does CVE-2026-38812 affect Ruoyi v4.8.2?
CVE-2026-38812 allows authenticated attackers with administrative privileges to exploit an SQL Injection vulnerability via the /tool/gen/createTable endpoint.
What is the potential impact of CVE-2026-38812?
The vulnerability can lead to unauthorized access to sensitive database information.
Who is vulnerable to CVE-2026-38812?
Users of Ruoyi v4.8.2 who have administrative privileges are vulnerable to CVE-2026-38812.
How can I remediate CVE-2026-38812?
To mitigate CVE-2026-38812, it is recommended to update to a patched version of Ruoyi that addresses the SQL Injection vulnerability.