RuoYi-Vue-Pro AppFileController Unauthenticated Path Traversal and Arbitrary File Write Vulnerability Analysis

ruoyi-vue-pro AppFileController Unauthenticated Path Traversal Leads to Arbitrary File Write #1146 Basic Information Vulnerability ID: VULN-01 Vulnerability Type: Missing Authentication (CWE-306) + Path Traversal (CWE-22) Severity: High CVSS 3.1: 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Component: YudaoModuleInfra (yudao-module-infra) Affected Versions: Tested on 2026-04-jdk8-SNAPSHOT Project URL: https://gitee.com/YunaiV/ruoyi-vue-pro Discovery Date: 2026-05-28 Report Status: Unfixed Vulnerability Description Overview In the of ruoyi-vue-pro, the file upload endpoint uses the annotation, allowing fully unauthenticated remote attackers to upload arbitrary files to the system. Simultaneously, and do not filter or normalize path traversal characters like and when constructing file storage paths. Combining these two vulnerabilities, an attacker can, without any credentials: 1. Write files to arbitrary directories on the server (within the same disk partition). 2. Overwrite frontend static pages to achieve persistent XSS. 3. Overwrite files in the system configuration directory; whether this further affects runtime configuration depends on the deployment method, configuration loading priority, and service restart conditions. 4. Write or overwrite arbitrary files; whether execution is possible depends on the deployment directory and runtime parsing methods. Root Cause Analysis Vulnerable call chain: Key code defects: 1. Missing Authentication: — allows unauthenticated users to upload. 2. Lack of Path Normalization: — is directly concatenated into the path. 3. No Filename Filtering: — retains as-is. 4. No Defense in Storage Path: — is pure concatenation. Impact Scope All instances deploying ruoyi-vue-pro and using "Local File Storage" ( ). Affected JDK 8 / JDK 11 / JDK 21 versions (independent of JDK version). Broader impact: Local filesystem storage; OSS/S3/SFTP storage is not affected by path traversal, but the unauthenticated upload issue still exists. Reproduction Steps Environment Target URL: http://localhost:28088 Storage Type: Local (id=36), is No Cookies, Tokens, or authentication headers required. POC 1: Unauthenticated File Upload Response (code=0 indicates success): Actual output: The file is written to . POC 2: Path Traversal — Write to Arbitrary Directory Response: Actual file write location: (already bypassed restriction, traversing to disk root). POC 3: Overwrite Frontend Pages for Persistent XSS (Verified) Use in the filename to cancel out the date directory in the path, precisely overwriting the target file. Actual result: Accessing http://localhost:1024 triggers an XSS alert, successfully reading cookies under the current domain. The Vite dev server detects file changes and refreshes automatically; the admin console page is completely replaced. Attackers can inject arbitrary JavaScript into files to: Steal admin page SessionTokens ( ). Forge requests to obtain admin passwords. Tamper with business data display. Harvest cookies via XSS. POC 4: Write to Application Configuration Directory This method attempts to overwrite files in the application configuration directory. Whether this further affects runtime configuration depends on the deployment method, configuration loading priority, and service restart conditions. Remediation Suggestions Short-term Remediation (Code-level) 1. Remove , unify security framework. 2. Filter path traversal characters. 3. Rewrite filenames (UUID recommended). 4. Restrict file write scope. Long-term Remediation (Architecture-level) Use object storage (OSS/S3) instead of local file storage. Enforce authentication for upload endpoints (JWT/OAuth2). Implement a whitelist mechanism for upload file types. Add rate limiting for uploads and enforce file size limits. Deploy WAF rules to intercept path traversal payloads. Vulnerability Impact Analysis Vulnerable Code Details 1. AppFileController — Unauthenticated Upload Entry Point File: 2. FileServiceImpl — Path Generation Unfiltered File: 3. LocalFileClient — No Defense in Storage Layer File: Remediation Suggestions Short-term Remediation (Code-level) 1. Remove , unify security framework. 2. Filter path traversal characters. 3. Rewrite filenames (UUID recommended). 4. Restrict file write scope. Long-term Remediation (Architecture-level) Use object storage (OSS/S3) instead of local file storage. Enforce authentication for upload endpoints (JWT/OAuth2). Implement a whitelist mechanism for upload file types. Add rate limiting for uploads and enforce file size limits. Deploy WAF rules to intercept path traversal payloads. Comments YunaiV on May 30 Fixed, thanks for the report. Fix commit: This commit retains for the App file upload interface but adds parameter validation. It also adds unified file path validation to reject illegal filenames, absolute paths, directory traversal, backslashes, Windows drive letters, etc. has also added boundary validation to ensure that the final read/write path does not cause local storage privil

Goal Reached Thanks to every supporter — we hit 100%!

RuoYi-Vue-Pro AppFileController Unauthenticated Path Traversal and Arbitrary File Write Vulnerability Analysis

More from this source