CVE-2026-129247

yangzongzhuan RuoYi Code Generator VelocityUtils.java VelocityUtils.getFileName path traversal

View on CVE.org
Published Nov 14, 2026 CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Description
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.

Analysis

AI-generated

Technical impact

A path traversal vulnerability exists in the VelocityUtils.getFileName method of the Code Generator component in yangzongzhuan RuoYi. By manipulating the className argument, an attacker can cause the method to output file paths that reference directories outside the intended location. The vulnerability can be triggered remotely, allowing an attacker to potentially read or access arbitrary files on the server where the application is deployed.

Affected Systems

The flaw affects installations of yangzongzhuan RuoYi (RuoYi) up to and including version 4.8.3. No affected versions beyond 4.8.3 are listed.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is remote, reliant on supplying a crafted className value to the vulnerable function. Exploitation would require network access to the application and lack of input validation for the className parameter.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RuoYi to a version newer than 4.8.3 that fixes the path traversal issue.
  • Restrict access to the Code Generation component by placing it behind authentication or a firewall to limit exposure to remote attackers.
  • Validate the className parameter to ensure it does not contain directory traversal sequences such as ‘..’ or ‘/’, or implement a strict whitelist of allowed values.

Generated by OpenCVE AI on November 14, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Yangzongzhuan
Yangzongzhuan ruoyi
Vendors & Products Yangzongzhuan
Yangzongzhuan ruoyi
Type Values Removed Values Added
Description A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.
Title yangzongzhuan RuoYi Code Generator VelocityUtils.java VelocityUtils.getFileName path traversal
First Time appeared Ruoyi
Ruoyi ruoyi
Weaknesses CWE-22
CPEs cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*
Vendors & Products Ruoyi
Ruoyi ruoyi
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 14, 2026, 10:30 AM
Reserved
Nov 13, 2026, 7:28 PM

View source JSON

No data.

Status
Deferred
Published
Nov 14, 2026, 11:17 AM
Modified
Nov 14, 2026, 11:17 AM

View source JSON

No data.

Updated
Nov 14, 2026, 5:30 PM

JSON