PT-2026-42935 · Yangzongzhuan · Ruoyi-Vue

Feng123123 · Published 2026-05-24 · Updated 2026-05-24 · CVE-2026-9374

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2026-9374

Affected Products

Ruoyi-Vue

References · 3

• https://vuldb.com/submit/813252 · Note
• https://vuldb.com/vuln/365338 · Note
• https://vuldb.com/vuln/365338/cti · Note