CVE-2026-129247: yangzongzhuan RuoYi Code Generator VelocityUtils.java VelocityUtils.getFileName path traversal
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.
Event History
Frequently Asked Questions
Which deployments are affected?
RuoYi versions up to 4.8.3 are affected where the Code Generator component uses VelocityUtils.getFileName. The issue is in the handling of the className argument.
What does an attacker need to exploit this issue?
An attacker needs the ability to remotely manipulate the className argument passed to VelocityUtils.getFileName. No user interaction is required, but the provided data does not specify the exact endpoint or access path that exposes this argument.
What is the potential impact?
Successful exploitation can cause path traversal through the generated filename path. The listed impact includes low confidentiality, integrity, and availability effects.