CVE-2026-9374: RuoYi-Vue RCE Vulnerability

CVE-2026-9374 Overview

CVE-2026-9374 is an unrestricted file upload vulnerability in yangzongzhuan RuoYi-Vue through version 3.9.2. The flaw resides in the FileUploadUtils.upload function exposed via the /common/upload endpoint of the Common Upload Endpoint component. Authenticated remote attackers can manipulate upload requests to bypass file type restrictions and place arbitrary files on the server. The vendor was contacted prior to disclosure but did not respond. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Authenticated attackers can upload arbitrary files through /common/upload, potentially enabling webshell deployment and follow-on compromise of the hosting application server.

Affected Products

yangzongzhuan RuoYi-Vue versions up to and including 3.9.2
FileUploadUtils.upload function within the Common Upload Endpoint
Applications exposing the /common/upload endpoint to authenticated users

Discovery Timeline

2026-05-24 - CVE-2026-9374 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9374

Vulnerability Analysis

RuoYi-Vue is a widely deployed Java-based rapid development framework built on Spring Boot and Vue. The /common/upload endpoint accepts file uploads from authenticated users for general-purpose attachment handling. The endpoint routes requests through the FileUploadUtils.upload function, which is responsible for validating file metadata before persisting the file to disk.

The vulnerability stems from insufficient access control and incomplete validation of uploaded content. An attacker with low-privilege credentials can manipulate the upload request to submit files that fall outside the intended allowlist. Once written to the server, these files may be reachable through the application's static resource paths, enabling subsequent execution or content abuse.

The issue is reachable over the network and requires only low privileges with no user interaction, broadening the attacker population to any user able to authenticate to the application.

Root Cause

The root cause is improper access control [CWE-284] in the upload handler. The FileUploadUtils.upload routine does not enforce sufficient restrictions on file type, extension, or destination path. Validation that should reject executable content or content with mismatched MIME types is either missing or trivially bypassed through request manipulation.

Attack Vector

An authenticated attacker sends a crafted multipart HTTP POST request to /common/upload containing a payload file with a manipulated filename, extension, or content-type header. The server stores the file in a location reachable through normal application routes. The attacker then accesses the uploaded resource to trigger execution or distribute malicious content. Refer to the VulDB entry for vulnerability 365338 for additional technical context.

Detection Methods for CVE-2026-9374

Indicators of Compromise

Unexpected files with executable extensions (.jsp, .jspx, .war, .html) in upload directories managed by RuoYi-Vue
HTTP POST requests to /common/upload from accounts that do not normally interact with file features
Outbound connections originating from the Java application process shortly after upload activity
New scheduled tasks, processes, or child shells spawned by the RuoYi-Vue JVM process

Detection Strategies

Inspect web server access logs for POST requests to /common/upload followed by GET requests to newly created file paths
Monitor the upload storage directory for files whose extension or magic bytes do not match the documented allowlist
Alert on JVM child processes such as /bin/sh, cmd.exe, or powershell.exe spawned by the RuoYi-Vue application

Monitoring Recommendations

Forward application and web server logs to a centralized SIEM and correlate authentication events with upload activity
Enable file integrity monitoring on directories used by FileUploadUtils.upload
Track per-user upload volume and file types to surface anomalous behavior from low-privilege accounts

How to Mitigate CVE-2026-9374

Immediate Actions Required

Restrict network exposure of the /common/upload endpoint to trusted internal users until a fix is available
Audit existing files in RuoYi-Vue upload directories and remove any content with executable extensions or unexpected MIME types
Rotate credentials for any account that may have interacted with the vulnerable endpoint
Review application logs for evidence of prior exploitation of /common/upload

Patch Information

No vendor patch is currently referenced in the public advisory. The vendor was contacted prior to disclosure but did not respond. Track the VulDB entry for vulnerability 365338 and the project repository for updates. Until a vendor fix is available, operators must apply compensating controls at the application and infrastructure layers.

Workarounds

Place a reverse proxy or web application firewall in front of RuoYi-Vue to block uploads with executable extensions and enforce strict content-type validation
Configure the upload storage directory to be served from a location that disables script execution, for example by removing JSP handler mappings
Add server-side validation to enforce an allowlist of file extensions and verify magic bytes match the declared content type
Run the RuoYi-Vue process under a least-privilege account that cannot write to web-executable paths

bash

# Example Nginx configuration to block execution of uploaded content
location /profile/upload/ {
    types { }
    default_type application/octet-stream;
    add_header Content-Disposition "attachment";
    location ~* \.(jsp|jspx|war|sh|php|html?)$ {
        deny all;
    }
}