Is CVE-2026-37216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37216 being exploited in the wild.

How severe is CVE-2026-37216?

Informational severity, with a CVSS score of 6.1, published 15 June 2026.

Is there a fix for CVE-2026-37216?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37216 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-37216?

Check whether you run RuoYi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37216: RuoYi stored XSS in notice management interface

CVE-2026-37216 · Severity: info · CVSS 6.1 · Published 2026-06-15

RuoYi, a popular management system framework, contains a security flaw in its notification and announcement module. An attacker with basic user permissions can create a malicious announcement that executes hidden code in the browsers of other users, including administrators. This could allow the attacker to perform unauthorized actions, such as creating new administrator accounts or stealing sensitive session information, potentially leading to a full takeover of the system.

Technologies: RuoYi. Vendors: RuoYi.

Quick answers

Is CVE-2026-37216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37216 being exploited in the wild.
How severe is CVE-2026-37216?: Informational severity, with a CVSS score of 6.1, published 15 June 2026.
Which products and versions are affected?: RuoYi 4.8.2, 4.8.3.
Is there a fix for CVE-2026-37216?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37216 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-37216?: Check whether you run RuoYi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in RuoYi versions 4.8.2 and 4.8.3 within the '/system/notice/add' interface. The vulnerability stems from the 'application.yml' configuration explicitly excluding the notice module from the XSS filter to support the Summernote rich text editor. Because the backend 'SysNoticeController' fails to perform server-side HTML sanitization (e.g., using Jsoup) and the frontend 'view.html' uses 'th:utext' to render raw HTML, an attacker with 'system:notice:add' permissions can inject malicious scripts. When combined with the application's disabled CSRF protection, this can be used to perform administrative actions, such as creating backdoor accounts, when an administrator views the malicious notice. Developers are advised to implement HTML sanitization using a library like Jsoup with a relaxed safelist in the 'addSave' and 'editSave' methods.

Affected products

yangzongzhuan RuoYi 4.8.2, 4.8.3

Timeline

2026-04-20: disclosed: Issue reported on GitHub repository
2026-06-15: advisory: CVE-2026-37216 published by NVD

References

https://github.com/yangzongzhuan/RuoYi/issues/320

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.