Is there a public PoC exploit available for EUVD-2026-40025?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40025. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for EUVD-2026-40025?

Yes, a patch is available for EUVD-2026-40025. Update the affected software to the latest version immediately.

ruoyi-vue-pro EUVD-2026-40025

Q: What is the CVSS score of EUVD-2026-40025?

EUVD-2026-40025 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-13528 MEDIUM

Path Traversal (CWE-22)

2026-06-29 VulDB

GHSA-6q7h-qg7r-3g9c

Java Path Traversal File Upload Ruoyi Vue Pro

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated upload endpoint, no interaction needed; all impact metrics Low as traversal enables bounded file read/write without full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 04:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 04:01 vuln.today

DescriptionCVE.org

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java of the component AppFileController File Upload Endpoint. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The patch is named 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue. This product is published by multiple vendors.

AnalysisAI

Path traversal in the ruoyi-vue-pro file upload endpoint exposes unauthenticated remote attackers to arbitrary file read and write operations via the generateUploadPath function in FileServiceImpl.java. All versions up to 2026.04-jdk8-SNAPSHOT are confirmed affected across both the YunaiV (GitHub) and zhijiantianya (Gitee) vendor distributions. Publicly available exploit code exists via GitHub issue #1146; no CISA KEV listing is present, but the unauthenticated network vector combined with a public proof-of-concept materially elevates operational risk above the CVSS 4.0 base score of 6.9 alone.

Technical ContextAI

ruoyi-vue-pro is a Java Spring Boot-based open-source rapid application development framework widely used in Chinese enterprise software projects. The vulnerable code resides in the yudao-module-infra module, specifically FileServiceImpl.java, within the generateUploadPath function called by the AppFileController file upload endpoint. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) arises here because user-supplied input - likely a filename or path parameter in the upload request - is incorporated into the constructed file storage path without canonicalization or boundary enforcement, allowing ../ or equivalent traversal sequences to escape the intended upload directory. The dual CPE entries (cpe:2.3:a:yunaiv:ruoyi-vue-pro and cpe:2.3:a:zhijiantianya:ruoyi-vue-pro) reflect the product's parallel distribution across GitHub and Gitee repositories under effectively the same codebase.

RemediationAI

Apply the vendor-released patch commit 4ae3f6b2c9883978837638c14e3d18419819eeb0 available on Gitee at https://gitee.com/zhijiantianya/ruoyi-vue-pro/commit/4ae3f6b2c9883978837638c14e3d18419819eeb0. A specific tagged release version incorporating this fix was not confirmed in the available data - operators should update to the latest repository HEAD and verify commit inclusion before deploying. As a compensating control while awaiting patch deployment, restrict network access to the AppFileController file upload endpoint via WAF rules or reverse-proxy ACLs, limiting it to authenticated internal users or known IP ranges; note this disables upload functionality for unrestricted users. Additionally, enforce input validation at the API gateway layer by rejecting request parameters containing traversal sequences (../, ..%2F, %2e%2e%2f) - this degrades gracefully but may require tuning to avoid false positives on legitimate filenames containing dots.