CVE-2026-76576 - yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

Back Back to CVE browser

MEDIUM

yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

Published Aug 19, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.47%

Description

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor Yangzongzhuan Product RuoYi-Vue Default
n/a
- Version
  3.9.0
  Status
  affected
  Constraints
  -
- Version
  3.9.1
  Status
  affected
  Constraints
  -
- Version
  3.9.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yangzongzhuan

RuoYi-Vue

n/a

Version	Status	Constraints
3.9.0	affected	-
3.9.1	affected	-
3.9.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62846
Advisory
https://github.com/yangzongzhuan/RuoYi-Vue/
product
https://github.com/yangzongzhuan/RuoYi-Vue/issues/151
exploitissue-tracking
https://vuldb.com/cve/CVE-2026-76576
third-party-advisory
https://vuldb.com/submit/877790
third-party-advisory
https://vuldb.com/vuln/393040
vdb-entrytechnical-description
https://vuldb.com/vuln/393040/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62846		Advisory
https://github.com/yangzongzhuan/RuoYi-Vue/		product
https://github.com/yangzongzhuan/RuoYi-Vue/issues/151		exploitissue-tracking
https://vuldb.com/cve/CVE-2026-76576		third-party-advisory
https://vuldb.com/submit/877790		third-party-advisory
https://vuldb.com/vuln/393040		vdb-entrytechnical-description
https://vuldb.com/vuln/393040/cti		signaturepermissions-required