# CVE-2026-13528: YunaiV ruoyi-vue-pro path traversal in AppFileController

Source: https://junglewise.ai/threats/cve-2026-13528-yunaiv-ruoyi-vue-pro-path-traversal-in-appfilecontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13528 · Severity: high · CVSS 7.3 · Published 2026-06-29

ruoyi-vue-pro, a popular Java-based administrative framework, contains a security flaw in its file upload system. An unauthenticated attacker can upload files to unintended locations on the server's hard drive by using special characters in the file path. This could allow an attacker to overwrite critical system files, deface the web interface, or potentially gain a foothold for further attacks on the organization's infrastructure.

Technologies: [YunaiV Ruoyi-Vue-Pro](https://junglewise.ai/threats/technologies/ruoyi-vue-pro). Vendors: [YunaiV](https://junglewise.ai/threats/vendors/yunaiv).

## Quick answers

**Is CVE-2026-13528 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13528 being exploited in the wild.

**How severe is CVE-2026-13528?** High severity, with a CVSS score of 7.3, published 29 June 2026.

**Which products and versions are affected?** YunaiV Ruoyi-Vue-Pro up to 2026.04-jdk8-SNAPSHOT.

**Is there a fix for CVE-2026-13528?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13528 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13528?** Check whether you run YunaiV Ruoyi-Vue-Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the `AppFileController` file upload endpoint of ruoyi-vue-pro. The root cause is a combination of missing authentication (due to the `@PermitAll` annotation) and insufficient validation of the `directory` parameter and original filename in `FileServiceImpl.java`. Specifically, the `generateUploadPath` function fails to sanitize or normalize path traversal sequences like `../`. An attacker can exploit this by sending a crafted multipart POST request to `/app-api/infra/file/upload` to bypass the intended storage directory. This allows for arbitrary file writes, which can be used to overwrite frontend assets for XSS or modify application configuration files. A patch has been identified in commit 4ae3f6b2c9883978837638c14e3d18419819eeb0.

## Affected products

- YunaiV / zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT

## Timeline

- 2026-05-28: disclosed: Vulnerability reported via GitHub issue #1146
- 2026-06-29: advisory: CVE-2026-13528 published by NVD/VulDB

## References

- [https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0](https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0)
- [https://github.com/YunaiV/ruoyi-vue-pro/](https://github.com/YunaiV/ruoyi-vue-pro/)
- [https://github.com/YunaiV/ruoyi-vue-pro/issues/1146](https://github.com/YunaiV/ruoyi-vue-pro/issues/1146)
- [https://github.com/YunaiV/ruoyi-vue-pro/issues/1146](https://github.com/YunaiV/ruoyi-vue-pro/issues/1146)
- [https://vuldb.com/cve/CVE-2026-13528](https://vuldb.com/cve/CVE-2026-13528)
- [https://vuldb.com/submit/840617](https://vuldb.com/submit/840617)
- [https://vuldb.com/vuln/374536](https://vuldb.com/vuln/374536)

## Related threats

- [YunaiV ruoyi-vue-pro authentication bypass in SMS verification](https://junglewise.ai/threats/cve-2026-116006-a-vulnerability-was-detected-in-yunaiv-zhijiantianya-ruoyi-vue)
- [ruoyi-vue-pro server-side request forgery in AI image service](https://junglewise.ai/threats/cve-2026-110610-ruoyi-vue-pro-through-2026-09-contains-a-server-side-request)
- [YunaiV ruoyi-vue-pro open redirect in OAuth2 Client](https://junglewise.ai/threats/cve-2026-97325-a-security-flaw-has-been-discovered-in-yunaiv-zhijiantianya-ruoyi)
- [RuoYi-Vue-Pro path traversal in file upload](https://junglewise.ai/threats/cve-2026-97323-a-vulnerability-was-determined-in-yunaiv-zhijiantianya-ruoyi-vue)
- [RuoYi-Vue-Pro file upload cross-site scripting in FileController](https://junglewise.ai/threats/cve-2026-97322-a-vulnerability-was-found-in-yunaiv-zhijiantianya-ruoyi-vue-pro)