Description

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T21:17:38.227Z",
  "pubdate": "2026-08-19T21:17:38.227Z",
  "executiveSummary": "A path traversal vulnerability exists in the yangzongzhuan RuoYi-Vue framework up to version 3.9.2, specifically within the Common Download Endpoint. The flaw resides in the fileDownload and resourceDownload functions located in ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. An unauthenticated or remotely authenticated attacker can exploit this vulnerability by manipulating the fileName or resource parameters to traverse the directory structure of the underlying file system. The impact of this security defect includes unauthorized remote retrieval of sensitive system files, configuration files, or source code. This represents a high-risk exposure due to the public availability of exploit details and the lack of an official vendor response or patch at the time of disclosure. Successful exploitation requires network access to the target application and does not necessitate complex privileges depending on the endpoint exposure.",
  "technicalDetails": "The vulnerability is rooted in insufficient input sanitization and validation within the file handling logic of the Common Download Endpoint in the yangzongzhuan RuoYi-Vue application. Specifically, the affected Java source file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java implements the fileDownload and resourceDownload functions, which process user-supplied parameters to locate and stream files back to the client. The root cause stems from the direct acceptance of the fileName or resource arguments without proper normalization, canonicalization, or restriction to a designated safe base directory.\nAn attacker initiates the exploitation sequence by sending a specially crafted HTTP request to the vulnerable download endpoint. The attack vector leverages directory traversal sequences, such as dot-dot-slash (../) representations or URL-encoded variants, within the fileName or resource parameters. When the backend application processes this input to construct the target file path, it fails to verify whether the resulting absolute path resides outside the intended root directory. Consequently, the underlying Java file I/O operations resolve the relative traversal sequences against the filesystem, allowing access to arbitrary files residing outside the web root.\nNetwork exposure for this component is typically remote, as the Common Download Endpoint is accessible over HTTP/HTTPS interfaces exposed by the web application. Depending on the specific deployment configuration and access control policies enforced by the RuoYi-Vue framework, the endpoint may be reachable without prior authentication or may require standard user session tokens. Upon successful traversal and file retrieval, the post-exploitation impact includes the potential exposure of critical system data, database credentials, application configuration files, and operating system artifacts, which can facilitate further compromise of the hosting infrastructure."
}