CVE-2026-76576: yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argument fileName/resource results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
RuoYi-Vue deployments up to version 3.9.2 are affected where the Common Download Endpoint and its fileDownload/resourceDownload functions are present. The issue can be attacked remotely over the network.
What access does an attacker need?
The provided severity vector indicates that an attacker needs low-level privileges and no user interaction. Exploitation involves manipulating the fileName or resource argument to traverse paths.
Is public exploitation information available?
Yes. The exploit has been made public, so organizations should treat exposed affected endpoints as potentially actionable by attackers.
Is a vendor fix available?
The data does not identify a fix. The project was notified through an issue report but had not responded at the time of publication.