CVE-2026-129247

MEDIUM 4.7

yangzongzhuan RuoYi Code Generator VelocityUtils.java VelocityUtils.getFileName path traversal

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.

CWE	CWE-22
Vendor	yangzongzhuan
Product	ruoyi
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for yangzongzhuan ruoyi

Be the first to know when new medium vulnerabilities affecting yangzongzhuan ruoyi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

yangzongzhuan / RuoYi

4.8.0 4.8.1 4.8.2 4.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/437278 vuldb.com: https://vuldb.com/vuln/437278/cti vuldb.com: https://vuldb.com/cve/CVE-2026-129247 vuldb.com: https://vuldb.com/submit/1042438

Credits

🔍 poppingsnack (VulDB User) VulDB Vulnerability Moderation Team