The RuoYi‑Vue application contains a flaw in the FileUploadUtils.upload routine located at /common/upload that accepts file uploads without proper validation. Because the endpoint authorizes any file type and size, an attacker can remotely upload arbitrary files, potentially including executable code. This can lead to privilege escalation, data tampering, or denial of service if the uploaded content is executed or misused by the system. The weakness is classified as CWE‑434 (Unrestricted Upload) and CWE‑284 (Improper Access Control).

Vendors and products affected include yangzongzhuan RuoYi‑Vue versions up to and including 3.9.2. The vulnerable code resides in the Common Upload Endpoint component and impacts all installations that have not applied newer releases.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is unavailable, so current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by issuing a POST request to /common/upload with arbitrary file data. No code execution is guaranteed solely by this upload, but the presence of unrestricted file upload opens significant attack vectors in properly configured environments.