CVE-2026-76576
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
RuoYi-Vue up to version 3.9.2 has a path traversal vulnerability in the fileDownload/resourceDownload function in CommonController.java. Manipulation of the fileName/resource argument allows remote attack, and the exploit has been made public.
Risk Assessment
An attacker can read arbitrary files from the server, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
Apply available patches or restrict access to the endpoint, and monitor logs for suspicious requests.
Other vulnerabilities in RuoYi-Vue
See all- CVE-2026-122016Medium
In yangzongzhuan RuoYi-Vue up to 3.9.2, the SysPermissionService.getMenuPermission function in SysPermissionService.java of the Permission Service component allows manipulation of the perms argument leading to improper privilege management. The attack can be initiated remotely; the vendor did not respond to the disclosure.
- CVE-2026-9374Medium
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2 in the FileUploadUtils.upload function in the /common/upload file of the Common Upload Endpoint component. Manipulation leads to unrestricted upload. The attack can be launched remotely. The vendor did not respond.
Original NVD description (English source)
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS