PatchSiren cyber security CVE debrief
CVE-2026-9374 yangzongzhuan CVE debrief
A vulnerability in yangzongzhuan RuoYi-Vue up to version 3.9.2 allows remote attackers to perform unrestricted file uploads via the FileUploadUtils.upload function in the /common/upload endpoint. The vulnerability stems from improper access control (CWE-284) and unrestricted upload of file with dangerous type (CWE-434), enabling attackers to upload potentially malicious files without adequate validation. The vendor was contacted prior to disclosure but did not respond. The vulnerability has a CVSS 4.0 base score of 5.3 (MEDIUM severity) with network attack vector, low attack complexity, and low privileges required. No known exploitation in the wild or ransomware campaign use has been documented.
- Vendor
- yangzongzhuan
- Product
- RuoYi-Vue
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-24
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-24
- Advisory updated
- 2026-05-26
Who should care
Organizations running RuoYi-Vue versions up to 3.9.2, particularly those exposing file upload functionality to untrusted users. Security teams should prioritize review of upload handling implementations and apply defensive controls pending vendor patch availability.
Technical summary
The vulnerability exists in the FileUploadUtils.upload function within the /common/upload endpoint of yangzongzhuan RuoYi-Vue versions up to 3.9.2. The endpoint fails to properly validate uploaded file types, allowing remote attackers with low privileges to upload files of arbitrary types. This can lead to remote code execution if the uploaded files are executable or contain malicious content that can be triggered through the application. The attack requires network access but no user interaction, with low attack complexity.
Defensive priority
medium
Recommended defensive actions
- Review and implement strict file type validation and extension whitelisting for all file upload endpoints
- Apply input sanitization and content-type verification independent of client-provided headers
- Implement server-side file storage outside web root with randomized filenames to prevent direct execution
- Consider deploying Web Application Firewall (WAF) rules to detect and block suspicious upload patterns
- Monitor for unauthorized file uploads and anomalous file access patterns in application logs
- Upgrade to a patched version when available from the vendor or consider implementing custom upload validation as interim mitigation
Evidence notes
Vulnerability identified in FileUploadUtils.upload function of /common/upload endpoint. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type) identified as primary weaknesses.
Official resources
The vendor was contacted early about this disclosure but did not respond in any way.