CVE-2026-38812: RuoYi v4

Synopsis

SQL injection in RuoYi v4.8.2 affects the code generation module's /tool/gen/createTable endpoint. The vulnerability is reachable over the network and, based on the CVSS vector, requires no authentication, though the description notes an admin-privileged account may be involved in practice. Successful exploitation gives an attacker read and write access to the underlying database and can disrupt service availability. No fix version has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS to deliver the malicious payload.

• AuthenticationNot required

  The CVSS vector assigns PR:N, indicating no credentials are required, though the vulnerability description notes the affected endpoint may in practice be accessible only to admin-privileged accounts.

• Victim interactionNot required

  No victim interaction is needed; the attacker can send a crafted request directly to the endpoint without any user action.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special conditions, race wins, or environmental setup beyond network access to the endpoint.

Blast Radius

• Reads arbitrary data from the underlying database, including stored credentials, session tokens, and application configuration records.
• Modifies or deletes persisted database rows, enabling tampering with application data or user accounts.
• Crashes or degrades the database service, causing a denial of service for all application functions that depend on it.
• Exposes the full schema and contents of any database accessible to the application's database user.