Arbitrary File Access in RuoYi-Vue-Plus Software by Dromara
CVE-2025-66916

9.4CRITICAL

Key Information:

Vendor

Dromara

Status
RuoYi-Vue-Plus
Vendor
CVE Published:
8 January 2026

What is CVE-2025-66916?

The snailjob component in RuoYi-Vue-Plus, specifically the interface at /snail-job/workflow/check-node-expression, is susceptible to arbitrary file access due to inadequate filtering of user input. Attackers can exploit this vulnerability by executing QLExpress expressions, enabling them to use the File class to read and write files without restriction. This can lead to unauthorized access to sensitive data and poses a significant risk to system integrity. It is crucial for users of affected versions to implement appropriate security measures.

References

https://gitee.com/dromara/RuoYi-Vue-Plus
https://github.com/Catherines77/code-au/blob/main/ruoyi-v...
https://gist.github.com/Catherines77/e3f06b9c4cc6298579e8...

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.