PT-2026-53198 · Unknown · Ruoyi-Vue-Pro

Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-13528

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.04-jdk8-SNAPSHOT

Description A path traversal issue exists in the AppFileController File Upload Endpoint. The flaw is located within the generateUploadPath() function of the FileServiceImpl.java file. This allows a remote attacker to perform a manipulation that results in unauthorized access to files or directories outside the intended folder.

Recommendations Apply patch 4ae3f6b2c9883978837638c14e3d18419819eeb0 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-13528

Affected Products

Ruoyi-Vue-Pro

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-13528 · Security Note
• https://github.com/YunaiV/ruoyi-vue-pro/issues/1146 · Note
• https://vuldb.com/cve/CVE-2026-13528 · Note
• https://vuldb.com/vuln/374536/cti · Note
• https://github.com/YunaiV/ruoyi-vue-pro · Note
• https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0 · Note
• https://twitter.com/VulmonFeeds/status/2071469421281825050 · Twitter Post
• https://vuldb.com/submit/840617 · Note
• https://vuldb.com/vuln/374536 · Note
• https://github.com/YunaiV/ruoyi-vue-pro/issues/1146#issuecomment-4583281212 · Note