Unrestricted File Upload in RuoYi-Vue by yangzongzhuan

CVE-2026-9374

What is CVE-2026-9374?

A serious vulnerability exists in the RuoYi-Vue framework due to improper handling in the FileUploadUtils.upload function within the Common Upload Endpoint. This flaw allows attackers to exploit the upload mechanism, leading to unauthorized file uploads. Such access gives remote attackers the potential to execute malicious code, resulting in severe implications for system security. The vendor was notified about the issue but has not provided any response, raising concerns about the timely implementation of necessary updates to mitigate risks.

References