The vulnerability CVE-2026-9374 affects the RuoYi-Vue product by yangzongzhuan in versions 3.9.0 through 3.9.2. It arises from insufficient restrictions in the FileUploadUtils.upload function within the common upload endpoint, allowing an attacker with low privileges to perform unrestricted file uploads remotely. This could potentially lead to unauthorized file placement on the server. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. The vendor has not provided any patch or remediation guidance, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with low privileges to upload files without restriction, which may lead to unauthorized file storage on the server. The impact on confidentiality, integrity, and availability is limited but could vary depending on the uploaded content and server configuration. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary controls such as restricting access to the upload endpoint, validating and sanitizing uploaded files at the application or web server level, and monitoring for suspicious upload activity. Avoid exposing the upload functionality to untrusted users until a fix is released.