CVE-2026-108802

LowCVSS 3.5

Published: 12/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A vulnerability in y_project RuoYi up to 4.8.3 affects the renderDrawer function in the /system/dict/data/add file of the Dictionary Data Drawer Preview component. Manipulating the cssClass argument can lead to cross-site scripting. The attack can be performed remotely, and the exploit has been publicly disclosed.

Risk Assessment

The risk includes the possibility of executing malicious scripts in a user's browser, which could lead to session theft, data theft, or administrator account takeover. Public availability of the exploit increases the threat.

Recommendation

It is recommended to update y_project RuoYi to the latest patched version. Also restrict access to the admin panel and apply input filtering.

Other vulnerabilities in y_project RuoYi

CVE-2023-3163Low
A vulnerability was found in y_project RuoYi up to version 4.7.7, classified as problematic. It affects the function filterKeyword, where manipulation of the argument value leads to resource consumption.

Original NVD description (English source)

A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS