A remote cross‑site scripting vulnerability exists in the FileController component of the ruoyi‑vue‑pro framework. Manipulating the file upload can inject arbitrary scripts into the client browser, allowing an attacker to execute code on the target system. The specific function affected is not identified, but the flaw lies in how FileController.java processes uploaded files. This vulnerability maps to CWE‑79 and CWE‑94.

All installations of YunaiV or zhijiantianya ruoyi‑vue‑pro built up to the 2026.08 release date are affected. No versions beyond this point are known to be impacted.

The reported CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited documented exploitation. However, a public exploit exists and the description notes that an attacker can initiate the attack remotely by supplying a crafted upload to the vulnerable endpoint. This underscores the need for timely remediation.