RuoYi CVE-2026-108802

Exploitation requires an authenticated low-privilege account on the RuoYi admin backend (PR:L) able to reach the Dictionary Data management feature at /system/dict/data/add and submit the cssClass argument. The payload is stored, so execution additionally requires a second user to passively view the Dictionary Data Drawer Preview (renderDrawer), which triggers the injected script in that victim's browser (UI:P). Limiting factors: prior authentication is mandatory, the vulnerable path is an administrative dictionary-management function (not public-facing), and impact depends on a victim opening the preview - there is no unauthenticated or zero-interaction path. No vendor patch is available, so mitigation currently depends on input/output sanitization or restricting access to the dictionary feature.

This is a medium-severity stored cross-site scripting flaw (CWE-79) with a modest real-world priority. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P, score 5.1) indicates a network-reachable but privilege-gated issue: PR:L means an authenticated (low-privilege) account is required, UI:P means a victim must passively view the injected content, and impact is limited to low integrity (VI:L) with no confidentiality or availability impact. The 'E:P' exploit-maturity metric aligns with the confirmed public POC. Publicly available exploit code exists (GitHub, Bob-wentao security report), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - this is POC availability, not confirmed exploitation in the wild. Net assessment: a legitimate but lower-tier issue. The authentication requirement (PR:L) and need for victim interaction (UI:P) meaningfully constrain impact; this is NOT a drive-by unauthenticated RCE. Note the injection point is an administrative dictionary-management function, so the attacker already needs backend access, further narrowing the realistic threat to insider/second-order scenarios. No conflicting signals in the CVSS data itself; the main gap is the absence of EPSS/KEV telemetry to gauge actual exploitation interest.

An authenticated low-privilege user with access to the RuoYi admin backend submits a dictionary data entry via /system/dict/data/add, injecting a malicious payload into the cssClass argument. When another user (e.g., an administrator) opens the Dictionary Data Drawer Preview, the renderDrawer function reflects the stored payload and the script executes in their browser session. A public POC demonstrating this stored XSS is available on GitHub.