ruoyi-vue-pro vulnerabilities

A flaw was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 in the function SmsCodeServiceImpl.validateSmsCode0 of /service/sms/SmsCodeServiceImpl.java, related to SMS code verification. The manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely, though its complexity is rather high and exploitability is regarded as difficult; the exploit has been published.

A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. An unknown function in AuthController.java handling SMS code verification improperly processes the mobile/code arguments, resulting in improper authentication. The attack can be launched remotely and the exploit is publicly available.

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.

A security flaw was discovered in ruoyi-vue-pro up to 2026.08 in the validOAuthClientFromCache function of OAuth2ClientServiceImpl.java. Manipulation of the redirect_uri argument results in open redirect. The exploit is public and the vendor did not respond.

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the updateDemoOrderPaid function of PayDemoOrderController. Manipulation of the ID argument leads to improper authorization, and the attack can be initiated remotely. The exploit is publicly available and the vendor did not respond to the disclosure.

A vulnerability was found in ruoyi-vue-pro up to 2026.08 in the getOriginalFilename function of MpMaterialServiceImpl.java in the File Upload component. Manipulation leads to path traversal. The exploit is public and the vendor did not respond.

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the File Upload component, specifically in FileController.java. Manipulation of input leads to cross-site scripting (XSS). The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the GoView Data Endpoint component, specifically in the GoViewDataServiceImpl.getDataBySQL function. Manipulation of the sql argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

In YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08, the AiKnowledgeDocumentServiceImpl.readUrl function in AiKnowledgeDocumentServiceImpl.java (AI Knowledge Module component) allows a remote attacker to trigger server-side request forgery by manipulating the url argument. The exploit has been published, and the vendor has decided to retain the existing behavior without a code change.

A broken access control vulnerability in ruoyi-vue-pro through 2026.05 (fixed in commit 5d1fd70) in ErpSaleOrderController allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations due to incorrect permission namespace enforcement. Attackers can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders.

A missing authorization vulnerability in the CRM module of ruoyi-vue-pro (up to version 2026.05, fixed in commit c779a47) exists in the GET /admin-api/crm/follow-up-record/get endpoint. Authenticated users can read any follow-up record by iterating sequential numeric IDs.

A path traversal vulnerability was found in ruoyi-vue-pro up to version 2026.04-jdk8-SNAPSHOT in the generateUploadPath function of FileServiceImpl.java. An attacker can remotely manipulate the file path, leading to unauthorized access to resources.

A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09 affecting the file /crm/business/transfer, leading to improper authorization. The attack can be launched remotely and the exploit is publicly available. The vendor confirms controllers check update permissions and require CRM OWNER permission.

A flaw was found in YunaiV ruoyi-vue-pro up to 2025.09 affecting the file /crm/contact/transfer, where manipulation of the ids/newOwnerUserId arguments causes improper authorization. The attack can be carried out remotely and the exploit has been published.

A security vulnerability was detected in YunaiV ruoyi-vue-pro up to 2025.09 affecting the file /crm/contract/transfer, where manipulation of the id/newOwnerUserId arguments leads to improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. An unknown function of the file /admin-api/infra/file/upload in the Backend File Upload Interface component is affected; manipulation of the path argument leads to path traversal. The attack may be performed remotely, and the exploit is publicly available and might be used. The patch is named 4ae3f6b2c9883978837638c14e3d18419819eeb0.

A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. An unknown function of the file /app-api/infra/file/upload in the Front-End Store Interface component is affected; manipulation of the path argument causes path traversal. The attack can be carried out remotely, and the exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0.