CVE-2026-13528: RuoYi-Vue-Pro Path Traversal Vulnerability

CVE-2026-13528 Overview

CVE-2026-13528 is a path traversal vulnerability in the YunaiV/zhijiantianya ruoyi-vue-pro project, affecting versions up to 2026.04-jdk8-SNAPSHOT. The flaw resides in the generateUploadPath function within yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java, invoked by the AppFileController file upload endpoint. Remote attackers can manipulate the upload path to traverse directories outside the intended storage location. A public exploit exists, and the maintainers released a patch identified by commit 4ae3f6b2c9883978837638c14e3d18419819eeb0. The vulnerability is categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can write files to arbitrary locations on the server file system through the file upload endpoint, enabling potential code execution or data tampering.

Affected Products

YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT
yudao-module-infra component containing FileServiceImpl.java
Deployments exposing the AppFileController file upload endpoint

Discovery Timeline

2026-06-29 - CVE-2026-13528 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13528

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of user-controlled input used to construct file storage paths. When a client submits an upload request through the AppFileController, the generateUploadPath function in FileServiceImpl.java incorporates untrusted values into the destination path without normalizing traversal sequences such as ../. Attackers can supply crafted path components to escape the designated upload directory. The endpoint is reachable over the network without authentication, and exploitation requires no user interaction. Exploit code is publicly available, increasing the risk of opportunistic scanning and abuse. Successful exploitation impacts confidentiality, integrity, and availability of files hosted by the application. The EPSS score is 0.447% with a percentile of 35.835.

Root Cause

The generateUploadPath function builds file paths through string concatenation without applying canonical path validation. Traversal sequences and absolute path segments in user-supplied filenames or path parameters are not rejected. This is a classic [CWE-22] path traversal pattern in server-side file handling logic.

Attack Vector

An unauthenticated remote attacker sends a POST request to the AppFileController upload endpoint containing a filename or path parameter that includes directory traversal sequences. The application resolves the manipulated path and writes attacker-controlled content outside the intended storage directory. Depending on server layout and permissions, this can overwrite configuration files, place web-executable payloads within served paths, or corrupt application data. See the Gitee Commit Change for the fix applied to the path generation logic.

Detection Methods for CVE-2026-13528

Indicators of Compromise

HTTP requests to the AppFileController upload endpoint containing ../, ..\\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths in filename parameters.
Files appearing in directories outside the configured upload storage location, particularly under web-served paths or system directories.
Application log entries from FileServiceImpl referencing unexpected upload destinations.

Detection Strategies

Inspect web server and application logs for upload requests carrying suspicious filename or path values, especially traversal metacharacters.
Monitor file creation events on the host, correlating new files against the application's expected upload directory.
Deploy web application firewall rules that flag or block path traversal patterns in multipart form data targeting the vulnerable endpoint.

Monitoring Recommendations

Enable file integrity monitoring on directories adjacent to and above the configured upload path.
Alert on process creation events spawned by the Java application user shortly after upload activity.
Track outbound connections from the application host that follow anomalous file writes, indicating possible webshell staging.

How to Mitigate CVE-2026-13528

Immediate Actions Required

Apply the upstream patch commit 4ae3f6b2c9883978837638c14e3d18419819eeb0 from the ruoyi-vue-pro repository.
Restrict network exposure of the AppFileController endpoint to trusted clients until patching is complete.
Audit the upload storage tree and adjacent directories for unexpected files written before remediation.

Patch Information

The maintainers published a fix in commit 4ae3f6b2c9883978837638c14e3d18419819eeb0, available through the Gitee Commit Change and tracked in GitHub Issue #1146. Additional advisory details are available at VulDB CVE-2026-13528. Rebuild and redeploy the yudao-module-infra module after pulling the patched revision.

Workarounds

Place a reverse proxy or WAF rule in front of the application that rejects requests to the upload endpoint containing .., backslashes, or encoded traversal sequences in filename fields.
Run the Java application process under a low-privilege account with write access restricted to the intended upload directory via filesystem ACLs.
Enforce SELinux or AppArmor confinement so the application cannot write outside its designated storage path even if traversal is attempted.

bash

# Configuration example: nginx rule to block traversal in upload requests
location /app-api/infra/file/upload {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://ruoyi_backend;
}