CVE-2026-7678 YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
Remote attackers can exploit SQL injection in the yudao-cloud reporting service to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7678?
CVE-2026-7678 is a medium-severity SQL injection vulnerability in YunaiV yudao-cloud, published on 3 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: "[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched."
Which versions are affected by CVE-2026-7678?
How do I fix CVE-2026-7678?
No fix has been published for CVE-2026-7678 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-7678 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7678 exists.
Sources
Also known as GHSA-7hx2-hqrg-qcwc.