CVE-2026-9374— yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| yangzongzhuan | RuoYi-Vue | 3.9.0 | affected |
3.9.1 | affected | ||
3.9.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9374
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
危险类型文件的不加限制上传
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yangzongzhuan | RuoYi-Vue | 3.9.0 | cpe:2.3:a:yangzongzhuan:ruoyi-vue:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-9374
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9374
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: yangzongzhuan
- CVE-2026-4564
yangzongzhuan RuoYi Quartz Job job code injection - CVE-2025-10989
yangzongzhuan RuoYi selectAll improper authorization - CVE-2025-10473
yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql - CVE-2025-10384
yangzongzhuan RuoYi Role cancelAll improper authorization - CVE-2025-8847
yangzongzhuan RuoYi edit cross site scripting
Same weakness: CWE-434
- CVE-2026-9445
SourceCodester Simple POS and Inventory System File Extensio - CVE-2026-9421
KLiK SocialMediaWebsite File upload.inc.php uniqid unrestric - CVE-2026-40412
Azure Orbital Spatio Remote Code Execution Vulnerability - CVE-2026-6960
BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upl - CVE-2026-45444
WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - A
V. Comments for CVE-2026-9374
No comments yet