CVE-2026-97322
Deferred Deferred - Pending Action

Cross-Site Scripting in RuoYi-Vue-Pro File Upload

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97322
EUVD
EUVD-2026-86398

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue found in the File Upload component of the YunaiV/zhijiantianya ruoyi-vue-pro software up to version 2026.08. It allows attackers to inject malicious scripts via an unknown function in the FileController.java file. The attack can be executed remotely and the exploit has been publicly disclosed.

Detection Guidance

This vulnerability involves a cross-site scripting (XSS) issue in a file upload component. Detection requires checking for improper input validation in the FileController.java file. Manually inspect the file for unfiltered user input in file uploads. Use static analysis tools like SonarQube or Checkmarx to scan the codebase for XSS vulnerabilities. Monitor network traffic for unusual file upload patterns or requests containing script tags.

Impact Analysis

This XSS vulnerability could allow attackers to execute malicious scripts in a user's browser when they interact with the affected application. This may lead to theft of session cookies, sensitive data exposure, or unauthorized actions on behalf of the user.

Compliance Impact

The vulnerability involves a cross-site scripting (XSS) flaw in a file upload component, which could allow remote attackers to inject malicious scripts. This may lead to unauthorized data access or manipulation, potentially violating GDPR (data protection) and HIPAA (health data privacy) compliance if sensitive user or patient data is exposed.

Mitigation Strategies

Update the affected component to the latest version or apply patches if available. Disable file upload functionality if not required. Implement input validation and output encoding to prevent XSS attacks. Monitor network traffic for suspicious activity related to file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart