CVE-2026-129247 in RuoYi
Summary
by MITRE • 11/14/2026
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified within the RuoYi framework, specifically affecting versions up to 4.8.3, centers on a critical implementation error in the Code Generator component's VelocityUtils class. This flaw resides within the getFileName method, which is responsible for processing user-supplied input related to the className argument during code generation tasks. The core technical deficiency is an insufficient validation of this input parameter, allowing attackers to inject directory traversal sequences such as dot-dot-slash characters into the filename construction logic. Because the framework processes these inputs without adequately sanitizing or restricting them against path manipulation patterns, it fails to confine file operations within the intended application directories. This lack of strict boundary enforcement creates a classic insecure direct object reference scenario where external input directly influences internal system resources without proper checks.
From an operational perspective, this vulnerability enables remote attackers to execute path traversal attacks with significant consequences for data integrity and confidentiality. By manipulating the className argument through network requests directed at the code generation endpoints, an attacker can dictate arbitrary file paths on the underlying server operating system. This capability allows for unauthorized reading of sensitive configuration files, source code, or other critical application resources that reside outside the web root directory. In more severe scenarios, depending on the specific deployment context and write permissions associated with the code generator's output directories, this flaw could potentially be leveraged to overwrite existing files or inject malicious content into generated artifacts, thereby facilitating further compromise of the host system. The remote nature of the attack vector means that exploitation does not require prior authentication in many default configurations where public endpoints are exposed for development purposes.
This vulnerability aligns with Common Weakness Enumeration category CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal attacks. The attack methodology corresponds to techniques found within the MITRE ATT&CK framework under Initial Access and Execution phases, specifically involving exploitation for credential access or file manipulation via web application vulnerabilities. Security practitioners should recognize that this type of flaw often stems from trusting user input in template engines like Apache Velocity without implementing strict allow-listing strategies for filename components. The absence of canonicalization checks before path resolution exacerbates the risk by allowing encoded or relative path sequences to bypass simple string matching defenses.
To mitigate this vulnerability, immediate remediation involves upgrading the RuoYi framework to a version later than 4.8.3 where the VelocityUtils class has been patched with robust input validation mechanisms. Developers must ensure that all user-supplied inputs used in file operations are strictly validated against an allow-list of permitted characters and patterns rather than relying on block lists for malicious strings. Implementing canonicalization checks to resolve any symbolic links or relative path references before performing filesystem operations is essential to prevent traversal attempts from succeeding. Additionally, applying the principle of least privilege by restricting the application's write permissions to only necessary directories can limit the impact even if an exploitation attempt occurs. For environments where code generation features are not actively required in production, disabling these endpoints entirely reduces the attack surface significantly. Regular security audits and static analysis scanning should be integrated into the development lifecycle to detect similar input handling flaws before deployment.