CVE-2025-14856 y_project RuoYi getnames code injection

Medium 5.3 Published 18 Dec 2025 Updated 24 Feb 2026

Remote attackers can execute arbitrary code via the getnames endpoint in RuoYi, requiring immediate patching.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-14856?

CVE-2025-14856 is a medium-severity code injection vulnerability in Ruoyi Ruoyi, published on 18 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2025-14856?

It affects 1 product.

Products include Ruoyi Ruoyi.

How do I fix CVE-2025-14856?

No fix has been published for CVE-2025-14856 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-14856 being exploited?

There is no known exploitation of CVE-2025-14856 in the wild and no public exploit code.

All Ruoyi Ruoyi vulnerabilities

Sources

Also known as GHSA-m5wr-8mwj-cqpw.