The vulnerability in yangzongzhuan RuoYi-Vue (up to version 3.9.2) allows remote attackers to perform unrestricted file uploads via the FileUploadUtils.upload function in the /common/upload endpoint. This flaw could enable attackers to upload arbitrary files without proper validation or restrictions. The vendor was contacted but has not provided a response or patch. The CVSS 4.0 score of 5.3 indicates a medium severity issue with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file storage on the server. This could be leveraged for further attacks depending on the server configuration and file handling, but specific impacts beyond unrestricted upload are not detailed. No known exploits have been reported in the wild.

No official fix or patch is currently available as the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or patches. Until a patch is released, consider implementing manual controls such as restricting upload functionality, validating file types and sizes at the application or web server level, and applying network-level protections to limit access to the upload endpoint.