Threats affecting pkg:github/zhijiantianya/ruoyi-vue-pro

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.

ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of the intended erp:sale-order namespace.

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.

CVE-2025-2708 is a path traversal vulnerability in the ruoyi-vue-pro product version 2.4.1 by zhijiantianya. It affects the backend file upload interface at the /admin-api/infra/file/upload endpoint. The flaw allows remote attackers to manipulate the path argument to traverse directories. Public exploit code exists for this vulnerability. A patch identified by commit 4ae3f6b2c9883978837638c14e3d18419819eeb0 is available to fix the issue.

CVE-2025-2707 is a path traversal vulnerability in zhijiantianya ruoyi-vue-pro version 2.4.1. It affects the /app-api/infra/file/upload component of the Front-End Store Interface. This flaw allows remote attackers to manipulate the path argument to access unauthorized files. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.