Path Traversal Vulnerability in yangzongzhuan RuoYi Code Generator
CVE-2026-129247

5.1MEDIUM

Key Information:

Vendor

Yangzongzhuan

Status
Ruoyi
Vendor
CVE Published:
14 November 2026

What is CVE-2026-129247?

A security flaw exists in the yangzongzhuan RuoYi Code Generator up to version 4.8.3. The vulnerability affects the 'VelocityUtils.getFileName' function in 'VelocityUtils.java', allowing attackers to manipulate the 'className' argument. This manipulation can enable path traversal, potentially leading to unauthorized access to sensitive files on the server. Attackers can exploit this vulnerability remotely, posing a significant risk to the integrity and confidentiality of server data.

Affected Version(s)

RuoYi 4.8.0

RuoYi 4.8.1

RuoYi 4.8.2

References

https://vuldb.com/vuln/437278
vdb-entrytechnical-description
https://vuldb.com/vuln/437278/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129247
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

poppingsnack (VulDB User)
VulDB Vulnerability Moderation Team
.