Vulnerability · Published Sep 24, 2026 · Assigned by VulDB

CVE-2026-97323YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal

Medium 6.3

In plain English

A medium-severity path traversal in ruoyi-vue-pro from YunaiV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
YunaiV	ruoyi-vue-pro	2026.08
zhijiantianya	ruoyi-vue-pro	2026.08

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-409331 | YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal vdb-entry, technical-description
VDB-409331 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-97323 | CVE Analysis and Report third-party-advisory
Submit #908274 | zhijiantianya ruoyi-vue-pro 2026.06 路径遍历 third-party-advisory