Is CVE-2026-9374 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9374 being exploited in the wild.

How severe is CVE-2026-9374?

Medium severity, with a CVSS score of 6.3, published 24 May 2026.

Is there a fix for CVE-2026-9374?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9374 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-9374?

Check whether you run RuoYi-Vue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9374: yangzongzhuan RuoYi-Vue unrestricted upload in Common Upload Endpoint

CVE-2026-9374 · Severity: medium · CVSS 6.3 · Published 2026-05-24

RuoYi-Vue, a popular management system framework, contains a security flaw in its file upload component. An attacker can bypass security restrictions to upload unauthorized files to the server. This could lead to the execution of malicious code, potentially allowing an attacker to compromise the server or disrupt business operations.

Vendors: RuoYi.

Quick answers

Is CVE-2026-9374 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9374 being exploited in the wild.
How severe is CVE-2026-9374?: Medium severity, with a CVSS score of 6.3, published 24 May 2026.
Which products and versions are affected?: RuoYi-Vue up to 3.9.2.
Is there a fix for CVE-2026-9374?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9374 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-9374?: Check whether you run RuoYi-Vue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability exists in RuoYi-Vue versions up to 3.9.2 within the FileUploadUtils.upload function of the /common/upload endpoint. The flaw stems from improper access control (CWE-284) and insufficient validation of uploaded file types (CWE-434). A remote attacker with low privileges can exploit this by sending a specially crafted request to the common upload component. Successful exploitation allows the attacker to upload arbitrary files, which could lead to remote code execution (RCE) depending on the server configuration. As of the disclosure date, the vendor has not responded to reports of this vulnerability.

Affected products

yangzongzhuan RuoYi-Vue up to 3.9.2

Timeline

2026-05-24: advisory: Vulnerability published on NVD
2026-05-24: disclosed: Public disclosure via VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.