CVE-2026-13528: Path Traversal in RuoYi-Vue-Pro File Upload (CVSS 7.3)

Technical summary

CVE-2026-13528 is a path traversal flaw (CWE-22) in the generateUploadPath function within FileServiceImpl.java of the RuoYi-Vue-Pro framework. The AppFileController's file upload endpoint fails to properly sanitize or validate the file path during upload operations, enabling attackers to use directory traversal sequences (such as ../ or absolute paths) to place files in arbitrary locations on the server filesystem. The CVSS v3.1 score of 7.3 reflects the high severity, with low attack complexity and no authentication requirement. The vulnerability affects versions up to 2026.04-jdk8-SNAPSHOT.

Business impact

Organizations using RuoYi-Vue-Pro in production environments face significant risk. An attacker could overwrite critical application files, inject malicious code into the application directory, or exfiltrate sensitive data if upload directories are accessible. This could result in complete application compromise, data breaches, or lateral movement within the hosting infrastructure. The public nature of the exploit and low attack barrier make this an attractive target for opportunistic and sophisticated threat actors.

Affected systems

RuoYi-Vue-Pro versions up to and including 2026.04-jdk8-SNAPSHOT are vulnerable. The vulnerability resides in the file upload component used by the application framework. Organizations should inventory all instances of this framework, particularly those exposed to untrusted networks or integrated with other services. Downstream products and commercial distributions of RuoYi-Vue-Pro may also be affected; verify with your vendor.

Exploitability

This vulnerability is highly exploitable. The attack vector is network-based, requires no authentication, and involves low complexity—an attacker simply needs to send a crafted file upload request with path traversal payloads. Public exploit code is available, lowering the barrier to exploitation. The absence of user interaction requirements (no social engineering needed) further increases risk. Automated scanning and exploitation tools are likely already in circulation.

Remediation

Apply the patch identified by commit hash 4ae3f6b2c9883978837638c14e3d18419819eeb0 to your RuoYi-Vue-Pro installation immediately. If patching is not immediately feasible, implement compensating controls: restrict file upload functionality to authenticated users only, validate and sanitize all file paths using allowlist-based approaches, disable directory traversal sequences in upload parameters, and configure filesystem permissions to prevent write access outside designated directories. Monitor upload directories for unexpected files.

Patch guidance

Obtain the patched version from the official RuoYi-Vue-Pro repository using the commit hash 4ae3f6b2c9883978837638c14e3d18419819eeb0. Verify the patch includes proper input validation in the generateUploadPath function and secure path canonicalization. Test the patched version in a non-production environment to confirm upload functionality works as expected and no legitimate use cases are broken. Deploy during a maintenance window to minimize disruption. If using a commercial or third-party distribution of RuoYi-Vue-Pro, contact your vendor for patched releases and timelines.

Detection guidance

Monitor file upload endpoints for requests containing path traversal patterns (../, .., encoded variations like %2e%2e%2f, or absolute paths). Log and alert on any uploads that attempt to write outside the configured upload directory. Review recent file modifications in application directories to detect if exploitation has already occurred. Check web server access logs for POST requests to the /infra/file or similar endpoints with suspicious parameters. Implement Web Application Firewall (WAF) rules to block common path traversal signatures. Establish baseline file integrity monitoring on application directories to detect unauthorized changes.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (7.3), network accessibility, zero authentication requirement, low attack complexity, public exploit availability, and severe potential impact (file system compromise leading to code execution or data theft). Any organization running RuoYi-Vue-Pro should treat this as critical for remediation planning.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and confidentiality, integrity, and availability impacts (C:L/I:L/A:L). While individual impacts are rated as Low, the combination of exploitability factors and multi-faceted compromise potential justifies the HIGH rating. In real-world scenarios, this could enable escalation to remote code execution.

Frequently asked questions