RuoYi vulnerable to arbitrary file download

ÉLEVÉE 7.5CVE-2023-27025 · GHSA-h4c9-rr5m-32fm · Published 02/04/2023 · updated 17/06/2026

En bref

CVE-2023-27025 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant com.ruoyi:ruoyi, ruoyi (ruoyi).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.2% des vulnérabilités.
Correctif : mettre à jour vers 4.7.7 ou plus récent.

Package	Affected versions	Patched versions
com.ruoyi:ruoyi Maven	`< 4.7.7`	`4.7.7`
ruoyi ruoyi	`≤ 4.7.6`	No fix yet

Description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

NVD description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

References

nvd.nist.gov/vuln/detail/CVE-2023-27025 · ADVISORY
gitee.com/y_project/RuoYi · WEB
gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0 · WEB
gitee.com/y_project/RuoYi/issues/I697Q5 · WEB

Autres vulnérabilités de com.ruoyi:ruoyi

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.ruoyi:ruoyi

Maven

< 4.7.7

4.7.7

ruoyi

≤ 4.7.6

No fix yet

Description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

NVD description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

Autres vulnérabilités de com.ruoyi:ruoyi

Tout voir →