RuoYi vulnerable to arbitrary file download

HIGH 7.5CVE-2023-27025 · GHSA-h4c9-rr5m-32fm · Published 02/04/2023 · updated 17/06/2026

In short

CVE-2023-27025 is a HIGH (CVSS 7.5) vulnerability affecting com.ruoyi:ruoyi, ruoyi (ruoyi).
Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.2% of all vulnerabilities.
Fix: update to 4.7.7 or later.

Package	Affected versions	Patched versions
com.ruoyi:ruoyi Maven	`< 4.7.7`	`4.7.7`
ruoyi ruoyi	`≤ 4.7.6`	No fix yet

Description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

NVD description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

References

nvd.nist.gov/vuln/detail/CVE-2023-27025 · ADVISORY
gitee.com/y_project/RuoYi · WEB
gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0 · WEB
gitee.com/y_project/RuoYi/issues/I697Q5 · WEB

More vulnerabilities in com.ruoyi:ruoyi

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.ruoyi:ruoyi

Maven

< 4.7.7

4.7.7

ruoyi

≤ 4.7.6

No fix yet

Description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

NVD description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

More vulnerabilities in com.ruoyi:ruoyi

See all →