ruoyi-vue-pro EUVD-2026-86405

Requires an authenticated account (PR:L) on a ruoyi-vue-pro/yudao instance with access to the yudao-module-mp WeChat MP material upload feature; the attacker must be able to submit a multipart file whose original filename carries '../' traversal sequences that reach getOriginalFilename() in MpMaterialServiceImpl. Limiting factors: valid credentials and access to the MP material-upload component are needed (not unauthenticated), the WeChat MP module must be deployed/enabled, and realistic impact depends on filesystem write permissions of the application service account and whether traversal reaches a sensitive/web-served directory. No user interaction beyond the attacker's own request is required, and no vendor patch is currently available.

This is a genuinely low-priority issue on raw signals but warrants attention for internet-exposed Chinese-market deployments. The only CVSS provided is a VulDB CVSS 4.0 base of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) with E:P (proof-of-concept exploit maturity), indicating remote but authenticated (PR:L) exploitation with limited impact across confidentiality/integrity/availability. No EPSS score and no CISA KEV entry are provided, so there is no evidence of active or widespread exploitation - only a publicly disclosed PoC. VulDB's 2.1 rating is conservative for a path-traversal flaw in the getOriginalFilename() handling of an upload path: unsanitized '../' sequences in a multipart filename typically enable a file WRITE to an attacker-chosen location, which can be materially worse (potential webshell/overwrite → integrity or code execution) than the VC:L/VI:L/VA:L rating implies; this is a notable disagreement worth verifying. Countervailing limiter: exploitation requires an authenticated account (PR:L) and access to the WeChat MP material-upload feature, and no vendor fix exists because the vendor did not respond to disclosure. Net: low nominal severity, but the traversal-to-file-write nature plus a public PoC and absent patch means exposed instances should be treated above the 2.1 headline.

An authenticated low-privileged user of a ruoyi-vue-pro/yudao instance uploads a WeChat MP material file whose original filename contains directory-traversal sequences (e.g. '../../'), so getOriginalFilename() returns an attacker-controlled path and the file is written outside the intended upload directory. A public PoC has been disclosed, lowering the barrier to reuse; depending on writable paths, this can enable overwriting application files or planting a webshell for follow-on code execution. Exploitation is remote (AV:N) with low complexity but requires a valid account (PR:L).