# CVE-2026-37216: RuoYi stored XSS in notice management interface

Source: https://junglewise.ai/threats/cve-2026-37216-ruoyi-stored-xss-in-notice-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-37216 · Severity: info · CVSS 6.1 · Published 2026-06-15

RuoYi, a popular management system framework, contains a security flaw in its notification and announcement module. An attacker with basic user permissions can create a malicious announcement that executes hidden code in the browsers of other users, including administrators. This could allow the attacker to perform unauthorized actions, such as creating new administrator accounts or stealing sensitive session information, potentially leading to a full takeover of the system.

Technologies: [RuoYi](https://junglewise.ai/threats/technologies/ruoyi). Vendors: [RuoYi](https://junglewise.ai/threats/vendors/ruoyi).

## Quick answers

**Is CVE-2026-37216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37216 being exploited in the wild.

**How severe is CVE-2026-37216?** Informational severity, with a CVSS score of 6.1, published 15 June 2026.

**Which products and versions are affected?** RuoYi 4.8.2, 4.8.3.

**Is there a fix for CVE-2026-37216?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-37216 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-37216?** Check whether you run RuoYi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in RuoYi versions 4.8.2 and 4.8.3 within the '/system/notice/add' interface. The vulnerability stems from the 'application.yml' configuration explicitly excluding the notice module from the XSS filter to support the Summernote rich text editor. Because the backend 'SysNoticeController' fails to perform server-side HTML sanitization (e.g., using Jsoup) and the frontend 'view.html' uses 'th:utext' to render raw HTML, an attacker with 'system:notice:add' permissions can inject malicious scripts. When combined with the application's disabled CSRF protection, this can be used to perform administrative actions, such as creating backdoor accounts, when an administrator views the malicious notice. Developers are advised to implement HTML sanitization using a library like Jsoup with a relaxed safelist in the 'addSave' and 'editSave' methods.

## Affected products

- yangzongzhuan RuoYi 4.8.2, 4.8.3

## Timeline

- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-06-15: advisory: CVE-2026-37216 published by NVD

## References

- [https://github.com/yangzongzhuan/RuoYi/issues/320](https://github.com/yangzongzhuan/RuoYi/issues/320)

## Related threats

- [RuoYi SQL injection in code generation module](https://junglewise.ai/threats/cve-2026-38812-ruoyi-sql-injection-in-code-generation-module)
- [SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the…](https://junglewise.ai/threats/cve-2024-57521-sql-injection-vulnerability-in-ruoyi-v-4-7-9-and-before-allows-a)
- [RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While…](https://junglewise.ai/threats/cve-2025-67342-ruoyi-versions-4-8-1-and-earlier-is-affected-by-a-stored-xss)
- [Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the…](https://junglewise.ai/threats/cve-2025-46175-ruoyi-v4-8-0-is-vulnerable-to-incorrect-access-control-there-is-a)
- [An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department…](https://junglewise.ai/threats/cve-2025-56396-an-issue-was-discovered-in-ruoyi-4-8-1-allowing-attackers-to-gain)