PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38812 RuoYi CVE debrief

CVE-2026-38812 is a SQL Injection vulnerability in RuoYi v4.8.2. The issue exists in the code generation module and is accessible via the /tool/gen/createTable endpoint. An authenticated attacker with administrative privileges may be able to access sensitive database information. For more information, see resourceLinkAnnotations: [cve-org], [nvd], [ref-4].

Vendor
RuoYi
Product
RuoYi
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Users of RuoYi v4.8.2, particularly those with administrative privileges, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by a lack of proper input validation in the /tool/gen/createTable endpoint, allowing for SQL injection attacks.

Defensive priority

High

Recommended defensive actions

  • Update to a patched version of RuoYi, if available.
  • Implement additional security measures, such as input validation and sanitization, to prevent SQL injection attacks.
  • Restrict access to the /tool/gen/createTable endpoint to only authorized users.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide official information about the vulnerability. A source reference [ref-4] is also available on GitHub.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-38812 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-38812

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-38812 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-38812

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.