CVE-2026-76576: Path Traversal in yangzongzhuan RuoYi-Vue

This vulnerability exists in yangzongzhuan RuoYi-Vue up to version 3.9.2 in the CommonController.java file, specifically in the fileDownload/resourceDownload functions. By manipulating the fileName or resource parameters, an attacker can perform a path traversal attack, potentially accessing files outside the intended directory. The issue can be exploited remotely without user interaction and requires low attack complexity and privileges. The project has been notified but has not issued a fix or response. Public exploit code is available.

Successful exploitation allows an attacker to read arbitrary files on the server by traversing directories via manipulated input parameters. This can lead to unauthorized disclosure of sensitive information. The vulnerability does not require user interaction and can be triggered remotely with low complexity and privileges. No evidence of active exploitation in the wild is reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, restrict access to the vulnerable endpoints where possible and consider implementing web application firewall (WAF) rules to detect and block path traversal attempts targeting the fileDownload/resourceDownload functions.