{"id":"CVE-2026-129247","kind":"vulnerability","aliases":["CVE-2026-129247"],"related":[],"title":"RuoYi: code generator path traversal via className lets files be written","description":"A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.","summary":"RuoYi, a Java admin framework, has a path traversal flaw in its code generator: the className argument in VelocityUtils.getFileName is not sanitised. A remote attacker can use it to point generated file output outside the intended directory.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","ruoyi","self-hosted","spring"],"not_affected_if":["generator-disabled","unaffected-version"],"how_to_check":"- Check the RuoYi version in use (pom.xml or the project's version file); versions up to and including `4.8.3` are listed as affected.\n- Confirm whether the code generator module (VelocityUtils.java) is deployed in the running application.","fix":null,"status":"open","published_at":"2026-11-14T11:17:06+00:00","first_seen_at":"2026-11-14T11:28:52+00:00","triaged_at":"2026-11-14T11:30:37+00:00","updated_at":"2026-11-14T11:30:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-14T11:30:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"RuoYi: code generator path traversal via className lets files be written","impact":"medium","summary":"RuoYi, a Java admin framework, has a path traversal flaw in its code generator: the className argument in VelocityUtils.getFileName is not sanitised. A remote attacker can use it to point generated file output outside the intended directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ruoyi","java","spring","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker writes files outside the intended directory on the server","analyst_note":"Check the NVD entry and the RuoYi repository for the fixed version, whether the code generator is enabled by default, and whether authentication is required.","how_to_check":"- Check the RuoYi version in use (pom.xml or the project's version file); versions up to and including `4.8.3` are listed as affected.\n- Confirm whether the code generator module (VelocityUtils.java) is deployed in the running application.\n- unknown whether the sources list a non-default setting that gates exposure.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["generator-disabled","unaffected-version"],"who_is_affected":"Teams running RuoYi up to version 4.8.3 that include the Code Generator component. The flaw sits in the code generator's file naming, so applications that do not expose or use the generator are less exposed. The sources do not say whether the generator is enabled by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4556,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129247':14A,17A '-2026':13A,16A '4.8.3':73C 'admin':28B 'argument':41B,93C 'attack':49B,100C 'carri':105C 'classnam':7A,40B,94C 'code':2A,37B,86C 'compon':85C 'cve':12A,15A 'directori':61B 'discov':67C 'file':9A,56B,81C 'flaw':34B,64C 'framework':29B 'function':77C 'generat':3A,38B,55B,87C 'host':23B 'impact':74C 'intend':60B 'java':18B,27B 'let':8A 'manipul':90C 'output':57B 'outsid':58B 'packag':19B 'path':4A,32B,97C 'perform':88C 'point':54B 'possibl':102C 'remot':48B,107C 'result':95C 'ruoyi':1A,20B,25B,70C 'sanitis':46B 'secur':63C 'self':22B 'self-host':21B 'spring':24B 'travers':5A,33B,98C 'use':51B 'velocityutils.getfilename':43B,78C 'velocityutils.java':82C 'via':6A 'written':11A 'yangzongzhuan':69C","nicknames":[],"mitigations":[],"who_affected":"Teams running RuoYi up to version 4.8.3 that include the Code Generator component. The flaw sits in the code generator's file naming, so applications that do not expose or use the generator are less exposed. The sources do not say whether the generator is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","package","ruoyi","selfhosted","spring"],"campaign_type":null,"search_a":"'-129247':14A,17A '-2026':13A,16A 'classnam':7A 'code':2A 'cve':12A,15A 'file':9A 'generat':3A 'let':8A 'path':4A 'ruoyi':1A 'travers':5A 'via':6A 'written':11A","search_b":"'admin':28B 'argument':41B 'attack':49B 'classnam':40B 'code':37B 'directori':61B 'file':56B 'flaw':34B 'framework':29B 'generat':38B,55B 'host':23B 'intend':60B 'java':18B,27B 'output':57B 'outsid':58B 'packag':19B 'path':32B 'point':54B 'remot':48B 'ruoyi':20B,25B 'sanitis':46B 'self':22B 'self-host':21B 'spring':24B 'travers':33B 'use':51B 'velocityutils.getfilename':43B","search_c":"'4.8.3':73C 'argument':93C 'attack':100C 'carri':105C 'classnam':94C 'code':86C 'compon':85C 'discov':67C 'file':81C 'flaw':64C 'function':77C 'generat':87C 'impact':74C 'manipul':90C 'path':97C 'perform':88C 'possibl':102C 'remot':107C 'result':95C 'ruoyi':70C 'secur':63C 'travers':98C 'velocityutils.getfilename':78C 'velocityutils.java':82C 'yangzongzhuan':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129247","severity":null,"published_at":"2026-11-14T11:17:06+00:00","modified_at":"2026-11-14T11:17:07+00:00","first_seen_at":"2026-11-14T11:28:52+00:00","fetched_at":"2026-11-14T11:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}