CVE-2026-9374: falha de média gravidade em yangzongzhuan RuoYi-Vue
yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Produtos afetados
yangzongzhuan · RuoYi-VueCVEs relacionadas — yangzongzhuan RuoYi-Vue
No mesmo produto, das mais perigosas para as menos.
CVE-2026-76576MEDIUMyangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversalEPSS 0.5%CVE-2025-4537LOWyangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookieEPSS 0.3%CVE-2026-122016MEDIUMyangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges managementEPSS 0.3%