Executive brief
RuoYi-Vue, a popular management system framework, contains a security flaw in its file upload component. An attacker can bypass security restrictions to upload unauthorized files to the server. This could lead to the execution of malicious code, potentially allowing an attacker to compromise the server or disrupt business operations.
Technical details
An unrestricted file upload vulnerability exists in RuoYi-Vue versions up to 3.9.2 within the FileUploadUtils.upload function of the /common/upload endpoint. The flaw stems from improper access control (CWE-284) and insufficient validation of uploaded file types (CWE-434). A remote attacker with low privileges can exploit this by sending a specially crafted request to the common upload component. Successful exploitation allows the attacker to upload arbitrary files, which could lead to remote code execution (RCE) depending on the server configuration. As of the disclosure date, the vendor has not responded to reports of this vulnerability.
Affected products
- yangzongzhuan RuoYi-Vue up to 3.9.2
Timeline
- 2026-05-24: advisory: Vulnerability published on NVD
- 2026-05-24: disclosed: Public disclosure via VulDB