Yangzongzhuan RuoYi-Vue vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Yangzongzhuan RuoYi-Vue: 2 record(s), with affected versions and fixes.
CVE-2026-76576
Medium · 4.3
CWE-22 Aug 19, 2026
yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-9374
Medium · 6.3
CWE-284 May 24, 2026
yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.