CVE-2026-7678: YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7678?
CVE-2026-7678 has been classified with a high severity due to its potential for SQL injection, which could lead to unauthorized data access.
How do I fix CVE-2026-7678?
To fix CVE-2026-7678, update YunaiV yudao-cloud software to a version higher than 2026.01, which addresses this vulnerability.
Which products are affected by CVE-2026-7678?
CVE-2026-7678 affects YunaiV yudao-cloud up to the version 2026.01, specifically within the getDataBySQL function.
What type of vulnerability is CVE-2026-7678?
CVE-2026-7678 is a SQL injection vulnerability that can allow attackers to manipulate and access data through SQL queries.
When was CVE-2026-7678 identified?
CVE-2026-7678 was identified in January 2026, affecting specific functionalities within the YunaiV yudao-cloud application.