Description
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of the file VelocityUtils.java of the component Code Generator. Performing a manipulation of the argument className results in path traversal. The attack is possible to be carried out remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yangzongzhuan | RuoYi | 4.8.3 | — |
| yangzongzhuan | RuoYi | 4.8.1 | — |
| yangzongzhuan | RuoYi | 4.8.0 | — |
| yangzongzhuan | RuoYi | 4.8.2 | — |