CVE-2026-97323

MediumCVSS 6.3/10Last modified Sep 24, 2026

Description

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-973247.3A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file CVE-2026-973254.3A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function vali CVE-2026-973267.3A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown CVE-2026-973287.5The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a CVE-2026-97339.1Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is CVE-2026-973314.3The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on befor CVE-2026-973325.3The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where t CVE-2026-973337.1QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Up CVE-2026-973348.7The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrad CVE-2026-973357.7Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 an CVE-2026-973367.2The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, CVE-2026-973377.5The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versio