CVE-2025-9409: Lostvip Ruoyi-go Path Traversal Vulnerability

CVE-2025-9409 Overview

CVE-2025-9409 is a path traversal vulnerability [CWE-22] affecting lostvip-com ruoyi-go up to version 2.1. The flaw resides in the DownloadTmp and DownloadUpload functions within modules/system/controller/CommonController.go. An authenticated remote attacker can manipulate the fileName argument to traverse directories outside the intended download path. Public exploit details have been released, increasing the likelihood of opportunistic exploitation. The vendor was contacted but did not respond to the disclosure.

Critical Impact
Remote authenticated attackers can read arbitrary files from the server filesystem by supplying crafted fileName values to the download endpoints.

Affected Products

lostvip-com ruoyi-go versions up to 2.1
Component: modules/system/controller/CommonController.go
Functions: DownloadTmp and DownloadUpload

Discovery Timeline

2025-08-25 - CVE-2025-9409 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9409

Vulnerability Analysis

The vulnerability affects the file download handlers in ruoyi-go, a Go-based port of the RuoYi administrative framework. Both DownloadTmp and DownloadUpload accept a user-controlled fileName parameter without sanitizing path separators or relative traversal sequences. An attacker who can reach the download endpoints can supply sequences such as ../ to escape the intended directory and request files outside the application's upload or temporary storage locations.

Because the attack targets file read semantics, successful exploitation leads to disclosure of configuration files, source code, credentials, or other sensitive files readable by the application process. The attack requires low privileges, meaning any authenticated account with access to the affected endpoint can abuse it.

Root Cause

The root cause is missing input validation on the fileName parameter prior to constructing the filesystem path. The affected functions join user input directly with a base directory without canonicalizing the resulting path or verifying it remains within the intended parent directory. This maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation occurs over the network against the download endpoints exposed by CommonController.go. An attacker submits a crafted HTTP request where fileName contains relative traversal segments pointing to files outside the download root. The server resolves and returns the targeted file in the HTTP response. Public references on VulDB and the GitHub issue tracker describe the manipulation technique.

No verified exploit code is included here. Refer to the GitHub Issue #1, GitHub Issue #2, and VulDB entry 321250 for technical details.

Detection Methods for CVE-2025-9409

Indicators of Compromise

HTTP requests to download handlers containing ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes in the fileName parameter.
Access log entries targeting DownloadTmp or DownloadUpload with unusual filename values referencing system files such as /etc/passwd or application configuration files.
Unexpected HTTP 200 responses returning file contents outside the configured upload directory.

Detection Strategies

Deploy web application firewall rules that block directory traversal patterns in query and body parameters addressed to the download endpoints.
Enable verbose request logging on the ruoyi-go application and alert on fileName values containing path separators or traversal sequences.
Correlate authenticated session identifiers with anomalous file access patterns to detect credential abuse.

Monitoring Recommendations

Monitor process-level file reads from the ruoyi-go service account for access outside its designated upload and temporary directories.
Baseline normal filename lengths and character sets served by the download handlers and alert on deviations.
Review authentication logs for low-privilege accounts initiating unusual volumes of download requests.

How to Mitigate CVE-2025-9409

Immediate Actions Required

Restrict network exposure of the ruoyi-go administrative interface to trusted networks only.
Audit all accounts with access to the download functionality and revoke unnecessary privileges.
Deploy WAF signatures that reject requests containing path traversal patterns in the fileName parameter.

Patch Information

No vendor patch is available. The maintainer of lostvip-com/ruoyi-go did not respond to coordinated disclosure according to the public CVE record. Organizations should track the upstream repository for updates and consider forking and patching the DownloadTmp and DownloadUpload functions locally to canonicalize paths and verify containment within the intended base directory.

Workarounds

Place the application behind a reverse proxy that strips or rejects traversal sequences in download request parameters.
Run the ruoyi-go process under a dedicated low-privilege user with filesystem access limited to its upload and temporary directories using OS-level controls such as AppArmor, SELinux, or container volume mounts.
Implement an allowlist of valid filename patterns at the proxy layer, rejecting any value containing path separators or non-printable characters.

bash

# Example NGINX location rule to block traversal in fileName
location ~ ^/(DownloadTmp|DownloadUpload) {
    if ($arg_fileName ~* "(\.\./|\.\.\\|%2e%2e|/)") {
        return 403;
    }
    proxy_pass http://ruoyi_backend;
}