# CVE-2025-66916: The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface…

Source: https://junglewise.ai/threats/cve-2025-66916-the-snailjob-component-in-ruoyi-vue-plus-versions-5-5-1-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-08  
License: CC BY 4.0 with a link back

CVE-2025-66916 · Severity: critical · CVSS 9.4 · Published 2026-01-08

The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.

Technologies: [Dromara RuoYi-Vue-Plus](https://junglewise.ai/threats/technologies/ruoyi-vue-plus). Vendors: [Dromara](https://junglewise.ai/threats/vendors/dromara).

## Quick answers

**Is CVE-2025-66916 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66916 being exploited in the wild.

**How severe is CVE-2025-66916?** Critical severity, with a CVSS score of 9.4, published 8 January 2026.

**Which products and versions are affected?** Dromara RuoYi-Vue-Plus. The advisory does not name versions.

**Is there a fix for CVE-2025-66916?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66916?** Check whether you run Dromara RuoYi-Vue-Plus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Dromara RuoYi-Vue-Plus

## Related threats

- [RuoYi-Vue-Plus authorization bypass in SysUserServiceImpl](https://junglewise.ai/threats/cve-2026-119647-ruoyi-vue-plus-through-6-0-0-contains-an-authorization-bypass)
- [RuoYi-Vue-Plus insecure direct object reference in social login](https://junglewise.ai/threats/cve-2026-110106-ruoyi-vue-plus-through-6-0-0-contains-an-insecure-direct-object)
- [RuoYi-Vue-Plus authorization bypass in workflow task completion](https://junglewise.ai/threats/cve-2026-88616-ruoyi-vue-plus-authorization-bypass-in-workflow-task-completion)
- [Dromara RuoYi-Vue-Plus improper authorization in workflow controllers](https://junglewise.ai/threats/cve-2026-77795-dromara-ruoyi-vue-plus-improper-authorization-in-workflow)
- [dromara RuoYi-Vue-Plus missing authorization in FlwTaskController](https://junglewise.ai/threats/cve-2026-58176-dromara-ruoyi-vue-plus-missing-authorization-in-flwtaskcontroller)