Path Traversal in RuoYi-Vue-Pro File Upload Endpoint

Executive Summary

CVE-2026-13528 is a vulnerability in the ruoyi-vue-pro framework affecting the AppFileController component, specifically in the generateUploadPath function of the FileServiceImpl.java file. It involves a path traversal flaw combined with unauthenticated file uploads.

The vulnerability arises because the system allows remote attackers to upload files without any authentication due to the @PermitAll annotation, and it fails to properly sanitize or normalize user-provided directory paths. This enables attackers to use sequences like "../" to write files to arbitrary directories on the server.

This can lead to overwriting frontend static resources, enabling persistent cross-site scripting (XSS) attacks, or modifying project files, potentially altering application behavior.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several serious impacts:

• Attackers can upload arbitrary files to the server without any authentication.
• They can write files to any directory within the same disk partition by exploiting path traversal.
• Frontend static resources can be overwritten, leading to persistent cross-site scripting (XSS) attacks.
• Project files can be modified, potentially changing application behavior depending on deployment and configuration.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthenticated file upload attempts and path traversal payloads in requests to the AppFileController File Upload Endpoint.

Look for HTTP requests containing directory traversal sequences such as "../" or "..\" in the file path parameters.

You can monitor web server logs or use network traffic inspection tools to identify suspicious upload attempts without authentication.

• Use grep or similar commands on server logs to find traversal patterns, e.g., `grep -E "\.\./|\.\.\\" /var/log/nginx/access.log`
• Check for unauthenticated POST requests to the file upload endpoint, e.g., `grep 'POST /appfilecontroller/upload' /var/log/nginx/access.log | grep -v 'Authorization'`
• Use tools like curl or Burp Suite to manually test the upload endpoint with traversal payloads to confirm vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing the @PermitAll annotation from the AppFileController.uploadFile() method to enforce authentication.

Normalize and sanitize all user-provided file paths to prevent path traversal attacks.

Rewrite uploaded filenames to UUIDs to avoid overwriting important files.

Validate that file paths remain within the intended base directory before saving files.

As a longer-term solution, consider switching to object storage, implementing file type whitelists, and deploying Web Application Firewall (WAF) rules to block traversal payloads.

Useful 0 Not Useful 0