CVE-2026-9374 - yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload

Back Back to CVE browser

MEDIUM

yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload

Published May 24, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Yangzongzhuan Product RuoYi-Vue Default
n/a
- Version
  3.9.0
  Status
  affected
  Constraints
  -
- Version
  3.9.1
  Status
  affected
  Constraints
  -
- Version
  3.9.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yangzongzhuan

RuoYi-Vue

n/a

Version	Status	Constraints
3.9.0	affected	-
3.9.1	affected	-
3.9.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (3)

https://vuldb.com/submit/813252
third-party-advisory
https://vuldb.com/vuln/365338
vdb-entrytechnical-description
https://vuldb.com/vuln/365338/cti
signaturepermissions-required

Link	Providers	Tags
https://vuldb.com/submit/813252		third-party-advisory
https://vuldb.com/vuln/365338		vdb-entrytechnical-description
https://vuldb.com/vuln/365338/cti		signaturepermissions-required