CVE-2026-97323
Deferred Deferred - Pending Action

Path Traversal in RuoYi-Vue-Pro File Upload

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97323
EUVD
EUVD-2026-86405

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the YunaiV/zhijiantianya ruoyi-vue-pro software up to version 2026.08. It exists in the getOriginalFilename function within the file MpMaterialServiceImpl.java, specifically in the file upload component. An attacker can manipulate this function to perform path traversal, potentially accessing unauthorized files on the server.

Detection Guidance

This vulnerability involves path traversal in the getOriginalFilename function of the MpMaterialServiceImpl.java file. Detection requires checking for unusual file upload patterns or attempts to access files outside intended directories. Review server logs for suspicious file paths containing sequences like '../' or absolute paths. Inspect uploaded files for unexpected locations or permissions.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to access sensitive files on the server by bypassing intended file upload restrictions. This may lead to unauthorized data disclosure, system compromise, or further attacks depending on the exposed files.

Compliance Impact

The vulnerability allows path traversal via file upload manipulation, which could lead to unauthorized access to sensitive files. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by potentially exposing personal or protected health information. However, specific compliance impacts depend on the system's configuration and data stored.

Mitigation Strategies

Update the ruoyi-vue-pro component to a version beyond 2026.08 to address the path traversal vulnerability in the File Upload function. If an update is unavailable, restrict access to the vulnerable endpoint or disable file upload functionality until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart