CVE-2026-13528

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13528

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13528.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13528

Published

2026-06-29T02:45:11.922Z

Modified

2026-07-15T01:48:53.844458522Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal

Details

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java of the component AppFileController File Upload Endpoint. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The patch is named 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue. This product is published by multiple vendors.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13528.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/yunaiv/ruoyi-vue-pro

Affected ranges

Type

GIT

Repo

https://github.com/yunaiv/ruoyi-vue-pro

Events

Introduced

7606740d161372a83c8a0e1c3a00764cf63bcf6b

Last affected

7606740d161372a83c8a0e1c3a00764cf63bcf6b

Database specific

{
    "extracted_events": [
        {
            "introduced": "2026.04-jdk8-SNAPSHOT"
        },
        {
            "last_affected": "2026.04-jdk8-SNAPSHOT"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2026.*

2026.04-jdk8-SNAPSHOT

v2026.*

v2026.04(jdk8/11)

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13528.json"