CVE-2025-66916
Unknown Unknown - Not Provided
Arbitrary File Read/Write via QLExpress in RuoYi-Vue-Plus Snailjob

Publication date: 2026-01-08

Last updated on: 2026-01-08

Assigner: MITRE

Description
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-08
Last Modified
2026-01-08
Generated
2026-06-16
AI Q&A
2026-01-08
EPSS Evaluated
2026-06-15
NVD
CVE-2025-66916
EUVD
EUVD-2026-1432
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
dromara ruoyi-vue-plus to 5.5.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

An attacker can leverage this vulnerability to read and write arbitrary files on the affected system. This can lead to unauthorized data access, data manipulation, or system compromise, potentially resulting in loss of confidentiality, integrity, and availability of data and services. [3]

Executive Summary

This vulnerability exists in the snailjob component of RuoYi-Vue-Plus versions 5.5.1 and earlier. The interface /snail-job/workflow/check-node-expression executes QLExpress expressions but does not filter user input properly. This allows attackers to exploit the File class within QLExpress to perform arbitrary file reading and writing on the system. [3]

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade RuoYi-Vue-Plus to a version later than 5.5.1 where the issue is fixed. Additionally, restrict access to the /snail-job/workflow/check-node-expression interface to trusted users only, and implement input validation or filtering to prevent execution of arbitrary QLExpress expressions. Monitoring and blocking suspicious file read/write operations related to this interface can also help reduce risk. [3]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart