A flaw in the MpMaterialServiceImpl.getOriginalFilename method allows attackers to construct filenames that traverse directories. When an attacker uploads a file, the application may write that file to arbitrary locations on the server’s filesystem. If the chosen path references an executable or configuration file, the attacker can overwrite or inject malicious content, potentially leading to code execution or unauthorized configuration changes.

YunaiV and zhijiantianya provide the ruoyi‑vue‑pro framework, which includes the yudao-module‑mp file upload component. The vulnerability is present in all releases up to 2026.08; specific version numbers are not listed in the CNA data.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available although the vulnerability has been publicly disclosed and may have been exploited. The flaw can be triggered remotely via the file upload endpoint, raising the risk for publicly accessible deployments. The vulnerability is not listed in the CISA KEV catalog, but its potential for remote exploitation warrants immediate attention.