This vulnerability in YunaiV's ruoyi-vue-pro version 2026.08 affects the getOriginalFilename function in the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java. It allows remote attackers to perform path traversal attacks by manipulating file upload paths. The vulnerability is remotely exploitable without user interaction and has a medium impact on confidentiality, integrity, and availability. The vendor was contacted but did not provide a response or patch. The exploit details have been publicly disclosed.

Successful exploitation of this vulnerability could allow an attacker to access or overwrite files outside the intended directory via path traversal, potentially leading to unauthorized information disclosure or modification of files. The impact is rated medium due to limited scope and the requirement of some privileges (low privileges needed). No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider restricting file upload permissions and validating input paths as temporary mitigations until an official fix is released.