Ruoyi Vue Plus
CVE-2025-66916
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
AnalysisAI
RuoYi-Vue-Plus (through 5.5.1) allows arbitrary file read/write through QLExpress expression evaluation in the snailjob workflow node checker. Attackers can use the File class to access any file on the server. PoC available.
Technical ContextAI
The /snail-job/workflow/check-node-expression endpoint evaluates QLExpress expressions without filtering dangerous classes (CWE-94). Attackers can use java.io.File and related classes to read sensitive files (application.yml, database credentials) or write malicious files.
RemediationAI
Update RuoYi-Vue-Plus. Implement expression sandboxing that blocks File, Runtime, Process, and other dangerous classes.
More in Ruoyi Vue Plus
View allBroken function-level authorization in RuoYi-Vue-Plus through 5.6.2 allows any authenticated low-privileged user to mani
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerabilit
Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticat
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today