CVE-2026-76576

Deferred Deferred - Pending Action

Path Traversal in RuoYi-Vue Admin Component

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: VulDB

Description

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76576

EUVD

EUVD-2026-62846

Affected Vendors & Products

Vendor	Product	Version / Range
yangzongzhuan	ruoyi-vue	to 3.9.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the RuoYi-Vue framework up to version 3.9.2. It exists in the Common Download Endpoint, specifically in the fileDownload or resourceDownload function of CommonController.java. An attacker can manipulate the fileName or resource argument to access files outside the intended directory by sending a crafted request.

Detection Guidance

This vulnerability involves path traversal in the Common Download Endpoint of RuoYi-Vue due to improper handling of the fileName or resource arguments. To detect it, inspect network traffic for requests to /fileDownload or /resourceDownload endpoints with unusual fileName or resource parameters containing path traversal sequences like ../. Check server logs for suspicious file access patterns or unauthorized file reads.

Impact Analysis

This vulnerability allows remote attackers to read sensitive files on the server by exploiting path traversal. If exploited, it could lead to unauthorized access to confidential data, system files, or other restricted resources. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR (protecting personal data) and HIPAA (protecting health information). Unauthorized file access could expose sensitive data, resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable or restrict access to the Common Download Endpoint in RuoYi-Vue until a patch is available. Monitor network traffic for unusual file download requests with path traversal patterns like '../' in the fileName or resource parameters.

Hi! I’m here to help you understand CVE-2026-76576. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70