CVE-2026-9374 in RuoYi-Vue
Summary
by MITRE • 05/24/2026
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/25/2026
The vulnerability identified in yangzongzhuan RuoYi-Vue version 3.9.2 represents a critical security flaw within the file upload functionality of the application. This issue resides in the FileUploadUtils.upload method located within the /common/upload component, specifically within the Common Upload Endpoint module. The flaw allows attackers to bypass normal file validation mechanisms and upload arbitrary files to the server without proper restrictions. This represents a classic unrestricted file upload vulnerability that can have severe consequences for the affected system and its users.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the file upload process. When users attempt to upload files through the designated endpoint, the application fails to properly verify file types, extensions, or content signatures before storing files on the server. This allows malicious actors to upload potentially harmful files such as web shells, malicious scripts, or other executable content that could compromise the entire system. The vulnerability is classified as a CWE-434 Unrestricted Upload of File, which is a well-documented weakness in software applications that handle file uploads. The attack vector is remotely exploitable, meaning that an attacker does not require physical access to the system or local network privileges to execute the exploit.
The operational impact of this vulnerability is significant and multifaceted. An attacker who successfully exploits this flaw can gain unauthorized access to the server infrastructure, potentially leading to complete system compromise. The unrestricted nature of the upload capability means that malicious files could be uploaded and executed, creating persistent backdoors, data exfiltration capabilities, or denial of service conditions. This vulnerability directly aligns with several techniques described in the MITRE ATT&CK framework under the T1190 - Exploit Public-Facing Application and T1059 - Command and Scripting Interpreter tactics. The lack of vendor response to early disclosure attempts further compounds the risk, leaving users without official patches or mitigation guidance during the vulnerability window.
The security implications extend beyond immediate exploitation as the vulnerability creates persistent threats for the application's integrity and confidentiality. Successful exploitation could result in data breaches, system infiltration, and potential lateral movement within network environments where the application resides. Organizations using this version of RuoYi-Vue should consider implementing immediate mitigations such as restricting file upload capabilities, implementing strict file type validation, and deploying web application firewalls to monitor and block suspicious upload attempts. Additionally, the absence of vendor communication regarding this vulnerability highlights the importance of proactive security measures and the need for organizations to maintain awareness of third-party software security risks. The vulnerability demonstrates the critical importance of proper input validation and the potential consequences of failing to implement adequate security controls in file handling components.