RuoYi-Vue-Plus vulnerabilities

2 known vulnerabilities in RuoYi-Vue-Plus from Dromara. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  Ruoyi-vue-plus: Improper Control of Generation of Code

  CVE-2025-66916Jan 8, 2026Dromara

  The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file re

• 9.1 Critical severity

  RuoYi-Vue-Plus: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-6925Jun 30, 2025DromaraEPSS 1.05%

  A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The