CVE-2026-76576 in RuoYi-Vue
Summary
by MITRE • 08/20/2026
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within RuoYi-Vue versions up to 3.9.2 represents a critical security flaw located in the Common Download Endpoint, specifically affecting the fileDownload and resourceDownload functions implemented in the CommonController.java component of the ruoyi-admin module. This endpoint is designed to facilitate the retrieval of files from the server's filesystem by accepting user-supplied arguments for fileName or resource paths. The core technical deficiency lies in the insufficient validation and sanitization of these input parameters before they are used to construct file system access operations. By manipulating the argument values, an attacker can inject directory traversal sequences, such as dot-dot-slash characters, into the path string. This manipulation allows the application to resolve references outside of its intended web root or designated download directories, effectively breaking out of the sandboxed environment established by the framework's design intent.
This flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize special elements within file names that could cause files to be located in unintended directories. The operational impact of this vulnerability is severe, as it enables remote attackers to read arbitrary files from the server's filesystem. Depending on the configuration and permissions under which the application runs, an attacker may access sensitive configuration files containing database credentials or API keys, source code repositories revealing internal logic flaws, system logs exposing user data, or other critical infrastructure files. Since the exploit has been made public, automated scanning tools and malicious actors can readily leverage this vulnerability to compromise server integrity, leading to potential data breaches, unauthorized information disclosure, and further lateral movement within the network environment if combined with other vulnerabilities.
From a threat intelligence perspective, this attack vector aligns with techniques observed in the MITRE ATT&CK framework, particularly those related to Collection via File and Directory Discovery or T1083: File and Directory Discovery. The ability to traverse paths remotely places this vulnerability in the category of high-severity issues that require immediate remediation. Although the project maintainers were notified through an issue report early on, the lack of a public patch or response indicates that organizations running affected versions are currently exposed without official mitigation guidance from the vendor. Consequently, defensive measures must be implemented at the application level or infrastructure layer to mitigate risk until an official update is released.
To address this vulnerability, developers should implement strict input validation for all file path arguments passed to download endpoints. This includes enforcing allowlists of permitted characters and rejecting any input containing directory traversal sequences such as dot-dot-slash or encoded variants thereof. Additionally, the application logic must resolve the canonical path of the requested file and verify that it resides within an expected base directory before proceeding with the read operation. Infrastructure-level mitigations can also be employed, such as configuring web servers to deny requests containing suspicious path patterns or restricting filesystem permissions so that the application process has minimal access rights limited strictly to its required operational directories. Regular security audits and static code analysis tools configured to detect CWE-22 instances are recommended to prevent similar flaws in future development cycles.