TI-2022-13839 Aliases CVE-2022-32065 GHSA-6w2f-6wq3-rjvf

An arbitrary file upload vulnerability in the background management module of RuoYi…

LOW 26CWE-79Published 2022-07-13 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Code execution
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-434.

Summary

An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.

Why it matters now

EPSS 0.00968 62nd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed com.ruoyi:ruoyi (Maven): 4.7.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.ruoyi:ruoyi (Maven)	before 4.7.4	4.7.4	Patch available	GHSA-6w2f-6wq3-rjvf

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.ruoyi:ruoyi (Maven) Vendor— Affected before 4.7.4 Fixed in 4.7.4 Patch available GHSA-6w2f-6wq3-rjvf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ruoyi:ruoyi::::::::	up to 4.7.3	Vulnerable	yangzongzhuan

cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:* Versions up to 4.7.3 Vulnerable ·yangzongzhuan

Remediation

Fix · GHSA-6w2f-6wq3-rjvf com.ruoyi:ruoyi (Maven) Fixed in 4.7.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-32065
2026-10-03 Alias added: GHSA-6w2f-6wq3-rjvf

References

Exploit 2

Patch 1

https://github.com/yangzongzhuan/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6

Advisory 2

Other 1

https://github.com/yangzongzhuan/RuoYi

TI-2025-20797 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component CVSS 3.1CRITICAL 9.8
TI-2025-20796 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the… CVSS 3.1CRITICAL 9.8
TI-2025-20795 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave CVSS 3.1CRITICAL 9.8
TI-2025-20794 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the… CVSS 3.1CRITICAL 9.8
TI-2025-20792 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the… CVSS 3.1CRITICAL 9.8
TI-2025-20790 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter CVSS 3.1CRITICAL 9.8

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences