CVE-2026-76576: RuoYi-Vue Path Traversal Vulnerability

CVE-2026-76576 Overview

CVE-2026-76576 is a path traversal vulnerability [CWE-22] in the RuoYi-Vue administrative framework maintained by yangzongzhuan. The flaw resides in the fileDownload and resourceDownload functions inside ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java, part of the Common Download Endpoint. Attackers manipulate the fileName and resource arguments to traverse outside the intended download directory and read arbitrary files on the host. The issue affects RuoYi-Vue versions up to 3.9.2. The exploit has been publicly disclosed, and the maintainer has not responded to the upstream issue report at the time of publication.

Critical Impact
Remote authenticated attackers can read arbitrary files from the application server by supplying crafted path sequences to the download endpoint.

Affected Products

yangzongzhuan RuoYi-Vue versions up to and including 3.9.2
ruoyi-admin module — CommonController.java component
Common Download Endpoint (fileDownload, resourceDownload functions)

Discovery Timeline

2026-08-19 - CVE-2026-76576 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76576

Vulnerability Analysis

The vulnerability sits in the Common Download Endpoint implemented in CommonController.java. The fileDownload and resourceDownload handlers accept the fileName and resource request parameters and pass them into file-resolution logic without adequate normalization or containment. An attacker can inject ../ traversal sequences to escape the intended upload or resource directory. The handler then reads and returns the contents of the resolved file over HTTP, exposing configuration files, source code, credentials, or operating system files depending on process privileges. The attack is executed over the network with low complexity and requires low-privileged authentication.

Root Cause

The root cause is missing input sanitization on user-controlled file path parameters. The controller does not canonicalize the requested path or validate that the resolved file resides within a designated safe base directory. This is a textbook instance of Improper Limitation of a Pathname to a Restricted Directory [CWE-22].

Attack Vector

An authenticated user issues an HTTP request to the download endpoint with a fileName or resource parameter containing directory traversal sequences such as ../../ followed by a target path. The application resolves the path relative to its working or upload directory and streams the contents back in the response. No user interaction is required beyond the attacker's request. Public exploit details are available through the referenced VulDB entry and the GitHub issue discussion.

No verified proof-of-concept code is included here. Technical exploitation details are described in the vulnerability database references above.

Detection Methods for CVE-2026-76576

Indicators of Compromise

HTTP requests to /common/download or /common/download/resource containing ../, ..%2f, ..\\, or URL-encoded traversal sequences in the fileName or resource parameter.
Download responses that return file types outside the expected upload directory, such as .yml, .properties, .jks, or /etc/passwd content.
Repeated 200 OK responses from the download endpoint to a single low-privileged account enumerating filesystem paths.

Detection Strategies

Deploy web application firewall or reverse proxy rules that block traversal patterns in query and path parameters targeting /common/download* endpoints.
Enable verbose access logging on the ruoyi-admin application and alert on anomalous parameter content submitted to CommonController handlers.
Correlate authenticated session activity with unusual file access patterns to identify credential misuse against the download endpoint.

Monitoring Recommendations

Monitor application logs for stack traces or file-not-found errors originating in CommonController.fileDownload or CommonController.resourceDownload.
Track outbound response sizes and MIME types from the download endpoint to detect exfiltration of non-standard file types.
Baseline normal download volumes per user and alert on statistical deviations that suggest automated enumeration.

How to Mitigate CVE-2026-76576

Immediate Actions Required

Restrict network exposure of the RuoYi-Vue administrative interface to trusted networks or VPN clients until a patched build is available.
Review authentication logs and revoke any low-privileged accounts showing anomalous access to /common/download endpoints.
Apply web application firewall rules that reject requests containing .., %2e%2e, or absolute paths in fileName and resource parameters.

Patch Information

No official patch has been published by the maintainer at the time of writing. The project was notified through an upstream issue report but has not responded. Track the GitHub repository and issue #151 for remediation updates. Downstream forks and integrators should implement a custom fix that canonicalizes resolved paths and validates containment within an allow-listed base directory.

Workarounds

Modify CommonController.java locally to reject any fileName or resource value containing .., forward slashes, backslashes, or null bytes before file resolution.
Enforce canonical path validation by resolving the target file and confirming it starts with the absolute path of the intended upload directory.
Disable the fileDownload and resourceDownload routes entirely if they are not required by production workflows.

bash

# Example WAF rule (ModSecurity) to block traversal on RuoYi download endpoints
SecRule REQUEST_URI "@rx /common/download" \
  "chain,id:1026076576,phase:2,deny,status:403,msg:'CVE-2026-76576 path traversal attempt'"
  SecRule ARGS:fileName|ARGS:resource "@rx (\.\./|\.\.\\|%2e%2e)" "t:lowercase,t:urlDecodeUni"