CVE-2026-97322

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.09

Description A cross site scripting issue exists in the File Upload component within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java. This flaw allows a remote attacker to perform a manipulation that executes malicious scripts in the context of a user's session.

Recommendations Update ruoyi-vue-pro to a version newer than 2026.08. Restrict access to the FileController.java file within the File Upload component to minimize the risk of exploitation.