Executive brief
ruoyi-vue-pro, a popular Java-based administrative framework, contains a security flaw in its file upload system. An unauthenticated attacker can upload files to unintended locations on the server's hard drive by using special characters in the file path. This could allow an attacker to overwrite critical system files, deface the web interface, or potentially gain a foothold for further attacks on the organization's infrastructure.
Technical details
A path traversal vulnerability exists in the `AppFileController` file upload endpoint of ruoyi-vue-pro. The root cause is a combination of missing authentication (due to the `@PermitAll` annotation) and insufficient validation of the `directory` parameter and original filename in `FileServiceImpl.java`. Specifically, the `generateUploadPath` function fails to sanitize or normalize path traversal sequences like `../`. An attacker can exploit this by sending a crafted multipart POST request to `/app-api/infra/file/upload` to bypass the intended storage directory. This allows for arbitrary file writes, which can be used to overwrite frontend assets for XSS or modify application configuration files. A patch has been identified in commit 4ae3f6b2c9883978837638c14e3d18419819eeb0.
Affected products
- YunaiV / zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT
Timeline
- 2026-05-28: disclosed: Vulnerability reported via GitHub issue #1146
- 2026-06-29: advisory: CVE-2026-13528 published by NVD/VulDB
References
- https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0
- https://github.com/YunaiV/ruoyi-vue-pro/
- https://github.com/YunaiV/ruoyi-vue-pro/issues/1146
- https://github.com/YunaiV/ruoyi-vue-pro/issues/1146
- https://vuldb.com/cve/CVE-2026-13528
- https://vuldb.com/submit/840617
- https://vuldb.com/vuln/374536