CVE-2026-129247 · Package
NO FIX YET
RuoYi, a Java admin framework, has a path traversal flaw in its code generator: the className argument in VelocityUtils.getFileName is not sanitised. A remote attacker can use it to point generated file output outside the intended directory.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running RuoYi up to version 4.8.3 that include the Code Generator component. The flaw sits in the code generator's file naming, so applications that do not expose or use the generator are less exposed. The sources do not say whether the generator is enabled by default.
Not affected if generator-disabled, unaffected-version
Who cares java, ruoyi, self-hosted, spring
4.8.3 are listed as affected.No fix yet, per the sources.
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.