A file upload handling routine in the ruoyi-vue‑pro project contains a path traversal flaw in the generateUploadPath method. An attacker can craft a request that includes directory traversal sequences, causing the application to write or overwrite files in arbitrary locations on the server. Because the upload endpoint is reachable from the internet, obtaining a privileged file write can lead to execution of malicious code, effectively allowing remote code execution.

The vulnerability affects the ruoyi‑vue‑pro application maintained by YunaiV and zhijiantianya. Versions up to and including the 2026.04‑jdk8‑SNAPSHOT release are impacted. The flaw resides specifically in the AppFileController file upload endpoint implemented in FileServiceImpl.java.

The CVSS score of 6.9 indicates a medium severity vulnerability, but the public availability of an exploit and confirmation that remote exploitation is possible raise the practical risk significantly. With no EPSS data reported and no inclusion in the CISA KEV list, attackers can still target this flaw because it can be triggered via unauthenticated or minimal‑credential file upload requests. The likely attack vector is through the exposed upload API, where a malicious payload containing path traversal characters is supplied; the server then stores it in a chosen directory, potentially yielding arbitrary file overwrite or execution.