Threats affecting pkg:github/yangzongzhuan/RuoYi-Vue

CVE-2026-122016 is a medium severity vulnerability in yangzongzhuan RuoYi-Vue versions 3.9.0, 3.9.1, and 3.9.2. It involves improper privilege management in the SysPermissionService.getMenuPermission function, allowing remote attackers to manipulate permissions arguments. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.

CVE-2026-76576 is a path traversal vulnerability in yangzongzhuan RuoYi-Vue versions 3.9.0, 3.9.1, and 3.9.2. It affects the fileDownload/resourceDownload functions in the Common Download Endpoint, allowing remote attackers to manipulate fileName/resource arguments to access unauthorized files. The vulnerability has a medium severity with a CVSS score of 5.3. Exploit code has been publicly disclosed, but no official vendor response or patch is available yet.