RuoYi-Vue EUVD-2026-62846

Exploitation requires a valid low-privilege authenticated session in RuoYi-Vue - the CVSS 4.0 PR:L metric confirms authentication is necessary, and unauthenticated exploitation is not indicated. The fileDownload and resourceDownload endpoints in CommonController.java must be reachable by the attacker's account, which is typical in standard deployments. No non-default configuration is required beyond the standard deployment of RuoYi-Vue up to 3.9.2. Exploitation is limited to file read operations bounded by the OS-level permissions of the application service account; files not readable by that account are inaccessible. No user interaction is required once an authenticated session is established.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) scores 5.3, classifying this as medium severity. The PR:L metric is the primary mitigating factor - exploitation is gated behind a valid low-privilege authenticated session, meaningfully constraining the attack surface relative to a fully unauthenticated flaw. Impact is bounded to low confidentiality disclosure (VC:L) on the vulnerable system with no integrity or availability consequences and no scope change to subsequent systems. The E:P supplemental metric confirms a public exploit exists, raising exploitation likelihood above baseline for any authenticated user. No EPSS score was provided, and the vulnerability is absent from CISA KEV, so mass or automated exploitation has not been confirmed. The realistic danger concentrates in environments where RuoYi-Vue is exposed to untrusted but authenticated users - such as multi-tenant deployments or instances where low-privilege credentials have been compromised - where an attacker could read configuration files, credentials, or application internals accessible to the Java process account.

An authenticated user with a low-privilege account on a RuoYi-Vue instance sends an HTTP request to the Common Download Endpoint with a fileName parameter set to a path traversal string such as ../../WEB-INF/classes/application.yml, causing the server to resolve and return the contents of sensitive configuration files outside the intended download directory. The public exploit referenced in GitHub issue #151 demonstrates this technique, making reproduction straightforward for any session holder without requiring advanced tooling.