This vulnerability exists in the Common Download Endpoint of yangzongzhuan RuoYi-Vue up to version 3.9.2, specifically in the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. By manipulating the fileName or resource parameters in the fileDownload/resourceDownload functions, an attacker can perform path traversal to access files outside the intended directory scope. The vulnerability can be exploited remotely without user interaction or privileges beyond low-level access. Although the issue was reported early to the project, no official fix or remediation has been provided yet. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the server by traversing directories via manipulated input parameters. This can lead to unauthorized disclosure of sensitive information. The vulnerability does not require user interaction or elevated privileges, making remote exploitation feasible. However, the impact is limited to information disclosure and does not include code execution or privilege escalation based on the available data.

No official fix or patch is currently available from the vendor. Since the project has not responded to the issue report, users should consider implementing temporary mitigations such as input validation and sanitization on the fileName/resource parameters to prevent path traversal. Monitoring for exploitation attempts is advisable given the public availability of exploit code. Check the vendor advisory regularly for updates or official patches.