CVE-2026-9374
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2 in the FileUploadUtils.upload function in the /common/upload file of the Common Upload Endpoint component. Manipulation leads to unrestricted upload. The attack can be launched remotely. The vendor did not respond.
Risk Assessment
An attacker can upload malicious files such as scripts, potentially leading to remote code execution or website defacement.
Recommendation
Restrict allowed file types, implement content validation, and use antivirus mechanisms for uploaded files.
Other vulnerabilities in RuoYi-Vue
See all- CVE-2026-122016Medium
In yangzongzhuan RuoYi-Vue up to 3.9.2, the SysPermissionService.getMenuPermission function in SysPermissionService.java of the Permission Service component allows manipulation of the perms argument leading to improper privilege management. The attack can be initiated remotely; the vendor did not respond to the disclosure.
- CVE-2026-76576Medium
RuoYi-Vue up to version 3.9.2 has a path traversal vulnerability in the fileDownload/resourceDownload function in CommonController.java. Manipulation of the fileName/resource argument allows remote attack, and the exploit has been made public.
Original NVD description (English source)
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS